A reason a signature is not Valid.
public enum PdfSignatureProblemKind
ISO 32000-2 §12.8.1 and §12.8.3; RFC 5652 §5.4 and §5.6; RFC 5280 §6.1. The kinds before SubFilterUnsupported make a signature Invalid; the others make it Indeterminate.
kind:method, kind:property, kind:ctor. Press Esc to clear.AlgorithmUnsupportedA digest or signature algorithm is not one this validation implements on this platform (§12.8.3.1, Table 260).ByteRangeGapThe byte ranges leave out more of the file than the signature value: they do not start at the first byte, or leave a second gap (§12.8.1: the range "should be the entire PDF file ... excluding the signature value itself").ByteRangeInvalidThe ByteRange is not ascending, non-overlapping pairs of non-negative offset and length within the file (§12.8.1, Table 255).ByteRangeMissingThe signature dictionary has no ByteRange array of integers (§12.8.1, Table 255).CertificateExpiredA certificate of the chain expired before the validation time (RFC 5280 §6.1.3 (a)(2)).CertificateNotYetValidA certificate of the chain is not valid until after the validation time (RFC 5280 §6.1.3 (a)(2)).CertificateRevokedA certificate of the chain was revoked at or before the time it is validated at, by a CRL or an OCSP response its issuer signed (RFC 5280 §6.1.3 (a)(3), §5.3; RFC 6960 §2.2; ISO 32000-2 §12.8.3.4.6). ETSI EN 319 102-1 reports this as REVOKED_NO_POE: no proof shows the signature existed before the revocation.ChainIncompleteNo issuer of a certificate of the chain was found among the signature's, the extra and the trusted certificates.ChainUntrustedThe chain ends at a self-signed certificate that is not a trust anchor.ContentsMissingThe signature dictionary has no Contents string (§12.8.1, Table 255).ContentsOutsideGapThe bytes the byte ranges leave out are not this signature dictionary's Contents as one hexadecimal string (§12.8.3.3.1: it "shall fit precisely in the space between the ranges").DigestMismatchThe digest of the signed bytes is not the one the signature carries: the bytes changed after signing (§12.8.1).IssuerNotCertificateAuthorityA certificate that issued another is not a certification authority, or may not sign certificates (RFC 5280 §6.1.4 (k), (n)).KeyUsageNotPermittedThe signer certificate's key usage allows neither digital signatures nor non-repudiation (RFC 5280 §4.2.1.3).LockedFieldModifiedAn incremental update after the signature changed a form field the signature locks: its field's lock dictionary or its FieldMDP transform parameters name it (§12.7.5.5, Table 236; §12.8.2.4, Table 259).ModificationNotPermittedAn incremental update after the signature changed the document in a way the permissions in effect do not allow: those of the certification signature (§12.8.2.2, Table 257), narrowed by signed field locks (§12.7.5.5, Table 236). See Modifications.PathLengthExceededThe chain is longer than an issuer's path length constraint allows (RFC 5280 §6.1.4 (l), (m)).RevocationUnknownThe revocation status of a certificate of the chain is not known: an OCSP responder answered unknown, or, when RequireRevocationStatus is set, no CRL or OCSP response that applies at the validation time was found (ISO 32000-2 §12.8.3.4.6 to §12.8.3.4.8; RFC 6960 §2.2).SignatureEncodingInvalidThe signature value is not a CMS SignedData this validation can decode (§12.8.3.3.1; RFC 5652 §5).SignatureValueInvalidThe signature value does not verify with the signer certificate's public key (RFC 5652 §5.6).SignedAttributesInvalidThe CMS signed attributes lack the message digest or name another content type (RFC 5652 §5.3, §11.1, §11.2).SignedRevisionUnknownThe byte ranges do not end at the end of a revision of the file: at a %%EOF marker, and the end-of-line marker after it, that terminates a revision's trailer, so what was signed cannot be compared with what follows (§12.8.1: the range ends "to the end of the %%EOF comment, possibly followed by an optional EOL marker, terminating the incremental update that adds the digital signature dictionary"; §7.5.6).SignerCertificateMissingThe CMS object does not carry the certificate its signer information names (§12.8.3.3.1).SigningCertificateMismatchThe ESS signing-certificate or signing-certificate-v2 attribute does not identify the signer's certificate (§12.8.3.4.5 a): "if the hashes do not match, then the signature is considered invalid"; RFC 5035 §3, RFC 2634 §5.4). A time-stamp token without the attribute is reported too (RFC 3161 §2.4.1, RFC 5816 §2.2.1).SubFilterUnsupportedThe SubFilter names an encoding this validation does not implement (§12.8.3.1, Table 260).TimestampInvalidThe signature's time-stamp token does not check out (its signature, its message imprint over the signature value, or its signing-certificate attribute), so its time is not used (RFC 3161 §2.4.2 and Appendix A; ISO 32000-2 §12.8.3.4.8). Timestamp holds the reasons.