Everything below is a document with a valid signature and a reader who sees something else than was signed, or does not see the signature at all. Validators are silent about all of it, because the cryptography is fine. We see each of these in files customers send us; the first one came in the week this guide was written. The PDF analyser on this site reports each of them under Findings.
The fix is always in the prepare step, before the first signature; "Preparing the document" is the checklist form of this list. After signing, a change to any of this is a modification, and Adobe reports it as such.
/NeedAppearances true on a signed form
What. The AcroForm dictionary carries /NeedAppearances true. Form fillers leave it there so a viewer regenerates each field's appearance from its value on open.
Effect. Adobe Acrobat and Reader regenerate all field appearances, including the signed signature fields, and drop them; the document looks unsigned in Adobe while a validator, Nitro, PDFium and Poppler all show the signature. Two people looking at the same file disagree about whether it is signed.
Fix. Set /NeedAppearances to false or remove it before signing, or flatten the form. The filled fields already carry appearance streams, so nothing changes visually. A file that already has this cannot be repaired without a post-signature change.
Fillable fields that stay fillable
What. Text, choice or checkbox fields without the read-only flag (/Ff bit 1) and not covered by a FieldMDP lock or a DocMDP certification with P=1.
Effect. Changing a value after signing is "form filling" in the PDF model. Every signature stays valid, every validator says so, and the visible document no longer says what was signed. A BSN, a date or an amount can be edited under a valid qualified signature.
Fix. Make the fields read-only or flatten the form before signing. A FieldMDP lock (/Lock << /Action /All >> on the signature field) is a good addition. Do not use DocMDP P=1 if you intend to add a timestamp or DSS later; it forbids them.
The signature is not in /AcroForm /Fields
What. A signature dictionary that hangs off a page annotation, or off nothing, without a field in the AcroForm field tree pointing at it. Also: a document with signatures and no AcroForm at all.
Effect. Acrobat lists signatures from the field tree. One that is not there is missing from its signatures panel; a validator that scans objects still finds it.
Fix. Register the field in /AcroForm /Fields, put its widget in the page's /Annots, and set /SigFlags 3 (signatures exist, append only).
/SigFlags without bit 2
What. /SigFlags 1 or missing.
Effect. A viewer that saves the file may rewrite it instead of appending a revision. That destroys the signature.
Fix. /SigFlags 3.
Widget on no page, or hidden
What. A signature field with an appearance but no widget in any page's /Annots; or a widget with the Hidden or NoView annotation flag set.
Effect. The signature exists and is listed, but nothing is drawn where the user expects a signature block.
Fix. Add the widget to the page it belongs on; clear the flags. An intentionally invisible signature (no appearance at all) is fine and common; just decide it on purpose.
Bytes after the last signature
What. An incremental update after the last signature or document timestamp, so the tail of the file is covered by nothing.
Effect. If the update is a DSS or a later timestamp, harmless. If it changes content, annotations or field values, Adobe reports "modified after signing" and the reader may see something that was not signed.
Fix. Nothing after the last timestamp. For B-LTA, the archive timestamp is the last thing in the file, by definition.
DocMDP P=1 on a document you want to extend
What. A certification signature that allows no changes.
Effect. Adding a DSS or a document timestamp later, which B-LT and B-LTA require, is a forbidden change.
Fix. P=2 if you certify and want to extend, or do not certify and use FieldMDP for the fields.
Too little room in /Contents
What. The reserved /Contents is sized for a bare signature; the CMS with the chain, or with a timestamp token, does not fit.
Effect. Completion fails after the signer has already authorized. A retry means a new authorization.
Fix. Reserve generously at prepare, and know what the reservation is for. The signature's /Contents holds the signed attributes, the signature value, the certificate chain and, at B-T, the timestamp token: roughly 4 kB for a bare B-B with three certificates, 8 to 10 kB once a timestamp token is in there.
B-LT and B-LTA need nothing extra in that field. The revocation data goes into a /DSS dictionary in its own revision, and every document timestamp is a new field with its own /Contents, holding a bare TimeStampToken plus the TSA's chain: about 4 to 8 kB. Size that one too, and remember that every LTA renewal adds another one. Our own signing service uses a single generous number for both, 32768 bytes: reserving too much only costs file size, reserving too little fails after the signer has already authorized.
A DSS with certificates only
What. A /DSS dictionary that holds the certificates of the chains but no /OCSPs, no /CRLs and no /VRI, often followed by document timestamps.
Effect. The file looks like B-LT or B-LTA and is B-T. Validators report B-T; Acrobat does not show "LTV enabled". Once the CA's endpoints disappear, the signature can no longer be validated, whatever the timestamps say.
Fix. Fetch OCSP responses or CRLs for every certificate in both chains after the timestamp, write them into the DSS with a /VRI per signature, and only then add the document timestamp.
XFA next to the AcroForm
What. The form carries an /XFA entry.
Effect. Adobe renders the XFA form, every other viewer renders the AcroForm appearances; the visible document differs per viewer.
Fix. Remove the XFA or flatten before signing.
Checking for all of this at once
Run the prepared, still unsigned document through an inspector before the first signature. Cleverbase's PDF analysis reports NeedAppearances and open fields as "attention" on an unsigned document, so you catch them where they are still cheap to fix; by hand, look at the AcroForm dictionary and at every field's /Ff and /AP.