> For the complete documentation index, see [llms.txt](https://docs.emudhradigital.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.emudhradigital.com/documentation/digital-signature-validation-tool/what-gets-validated.md).

# What Gets Validated

For each signature, the tool performs the following checks.

| # | Check                          | Description                                                                                                                                                                  | Failure →                                 |
| - | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- |
| 1 | **Integrity**                  | Recomputes the document hash (PDF byte range / XML references / CMS content) and compares it with the signed digest.                                                         | Invalid — document modified after signing |
| 2 | **Cryptographic verification** | Verifies the signature value with the signer's public key and algorithm.                                                                                                     | Invalid                                   |
| 3 | **Certificate chain**          | Builds the path from the signer certificate to a trusted root (RCAI, configured trust lists).                                                                                | Indeterminate — untrusted chain           |
| 4 | **Validity period**            | Checks the certificate was valid at signing time (timestamp time, or claimed signing time). For eSign, the ≤30-minute one-time certificate must have been valid when signed. | Invalid / Indeterminate                   |
| 5 | **Revocation**                 | Uses embedded OCSP/CRL (LTV) or fetches live OCSP/CRL.                                                                                                                       | Invalid if revoked before signing time    |
| 6 | **Key usage & policy**         | Confirms key usage (digital signature / non-repudiation) and certificate class/policy OIDs (eKYC class, Document Signer).                                                    | Indeterminate                             |
| 7 | **Timestamp**                  | Validates RFC 3161 timestamp token and TSA certificate.                                                                                                                      | Indeterminate                             |
| 8 | **PDF modifications**          | Detects incremental updates after signing and classifies them (permitted form fill / annotations vs. disallowed changes).                                                    | Warning / Invalid                         |
| 9 | **Signer identity**            | Extracts signer name, organisation, eSign response code (pseudonym) and auth class for display.                                                                              | —                                         |

## Validation statuses

| Status            | Meaning                                                                                                        |
| ----------------- | -------------------------------------------------------------------------------------------------------------- |
| **Valid**         | All checks passed; the document is unchanged and the signer certificate was trusted and valid at signing time. |
| **Invalid**       | Integrity or cryptographic check failed, or the certificate was revoked/expired at signing time.               |
| **Indeterminate** | Validity could not be confirmed — e.g., unknown root, revocation information unavailable, missing timestamp.   |