Checked against the current Windows build. Where an article names a menu, a button or a message, that is the wording in the application, not a paraphrase.
An untrusted issuer is a fact about the machine doing the checking
A reader decides whether a certificate chains to a root it trusts, and root stores differ. An Indian certifying authority that a filing portal accepts without comment may be absent from the trust store of a laptop abroad, or of a reader that ships its own list instead of using Windows’. The signature is intact; the checker does not recognise who vouched for you.
Creasepoint says that in those terms rather than collapsing it into valid or invalid. Its verdict reads “intact, issuer not trusted here”, with a chain summary saying either that it chains to a trusted root in so many steps or that it does not. The word “here” is doing real work in that sentence. Re-signing does not fix this. The recipient installing the issuer’s root certificate does.
Changed after signing is the one that belongs to you
A PAdES signature covers a byte range, and moving one byte inside that range makes the check fail. That is the entire point of it. Most operations in this application rebuild the document as a single revision, and a signature does not survive being rebuilt — so a red banner appears above the pages as soon as you have changes pending on a signed file, saying that Save will replace the signed document with an unsigned one and that Save a copy leaves the signed file as it is.
Signing into an existing field and countersigning are the exceptions. They append a revision and leave the earlier bytes untouched, so the first signature still verifies over exactly what it signed. Which field you sign into decides which of those two you get, and the signing workflow sets out how that choice is made. If a reader reports that a signature covers an earlier revision rather than the whole file, that is normal where somebody signed after you, and it is what a modified document looks like otherwise. Establish which before you assume either.
Missing revocation data is not something this application can supply
Checking whether a certificate has been revoked means asking the issuing authority, over the network, at the moment of checking. Creasepoint makes no network requests, so revocation checking is switched off deliberately rather than left at a default that would quietly telephone a certificate authority on your behalf. Every verdict it produces carries a note saying exactly that, which most readers leave out of theirs.
The consequence is honest and awkward. A signature this application calls intact may have been made with a certificate that was revoked afterwards, and a reader complaining about missing revocation information is complaining about something real. If the recipient’s process requires embedded revocation data — LTV, in the language most readers use — it has to come from a tool that fetches it. Tell the recipient that rather than re-signing and hoping.
No timestamp means the signing time is your own clock’s word
Without a timestamp, the time recorded in a signature is whatever the signing machine’s clock said, and nothing attests to it. Readers vary in how loudly they complain about this, but the complaint is fair, and it becomes serious the day your certificate expires: a verifier then has no evidence that you signed while it was still valid.
The control is “Add a trusted timestamp” in the Sign panel, with a box beneath it where you choose or type a time authority. Nothing is pre-selected, because “the authority you chose” stops being true the moment we choose one for you. What crosses the wire is a hash of the signature value, sent by a separate helper program — never the document and never its name. That authority sees your address and the hour, and has its own data policy. Leave the box unticked and no request is made at all.
Read the verdict before you re-sign anything
Open the file here and any signature it carries is checked on this machine, over the exact byte range the signature declares, with the result summarised in the banner above the pages. From a script, creasepoint verify filing.pdf prints one block per signature: a one-word verdict, the signer, the issuer, the claimed time, whether it covers the whole file, what the chain check said, and the notes on what was not checked.
That is enough to sort the four cases apart. Broken means the bytes moved, and re-signing is the answer. Intact with an untrusted issuer is the reader’s trust store, and no amount of re-signing touches it. A note about revocation or a missing timestamp is neither of those: it is a limit of the check itself, and signing again without changing anything else produces the same complaint.
The two places worth looking next.
Read the matching guide if you want the reasoning rather than the fix, and check limitations before spending any longer on it — some of what people look for here is absent on purpose.