Security
What is long-term validation (LTV), and why can a signature 'expire' without it?
Long-term validation means packing everything a checker needs (the certificates in the chain, and the proof that none of them was cancelled) into the PDF itself. Without it, checking the signature years from now depends on outside services that may no longer exist.
The Digital Signature tool has a tick box called "Include long-term validation (LTV)". It sounds technical. The idea behind it is not.
The problem it solves
When someone checks a digital signature, the software asks several questions. Two of them need outside help:
- Who vouches for this certificate? It follows a chain from your certificate up to an authority it recognises. It may need to download some of those certificates.
- Was the certificate cancelled? Certificates can be revoked. Switched off early, like cancelling a stolen bank card. The software asks the issuer's service, "was this one still good?"
Both questions are answered by servers on the internet, run by the company that issued your certificate.
Now think about an employment contract signed today and opened again in 2033. That company may have been bought, renamed, or closed. Its servers are gone. The certificate expired long ago. Suddenly a perfectly honest signature cannot be confirmed, not because anything is wrong with it, but because nobody is left to answer the questions.
That is what people mean when they say a signature "expires". The signature is fine. The *evidence around it* has rotted away.
What LTV actually stores
With the option on, the tool collects the answers while they are still available and writes them into the PDF:
- every certificate in the chain, from yours up to the top,
- a fresh, signed statement from each issuer saying that certificate was not cancelled,
- the same for the certificates belonging to the timestamp service.
The file becomes self-contained. In 2033 a checker opens it, finds everything it needs inside, and can give an answer with no internet at all.
The everyday version
You buy a second-hand car. The seller says the service history is with the garage, and you can ring them any time. Fine: until the garage closes.
LTV is asking for copies of all the paperwork on the day of the sale, stapled to the receipt. Nothing new is proved. It simply means you will never have to rely on somebody else still being there.
Why it needs a timestamp first
You will notice the tick box is greyed out until "Add a trusted timestamp" is on. That is on purpose.
Stored evidence is only useful if you also know when it applied. Saying "this certificate was valid" is meaningless without "as of this date". The trusted timestamp supplies the date, so the two go together.
When it cannot be completed
Our tool is strict about this, and it will tell you.
Some certificates simply do not publish the information LTV needs. A certificate you made yourself, or one from a small in-house authority, often names no cancellation service at all. There is nothing to collect, so nothing can be stored.
When that happens the result page says "Long-term validation could not be completed, so the file was signed without it", and it gives the reason. Your document is still signed and still valid. It simply does not carry its own evidence.
The tool never says LTV was included when it was not. Every certificate in the chain must have a fresh, signed "not cancelled" answer before it counts as complete.
What happens if you leave it off
Nothing changes today. The signature is exactly as strong. The difference is entirely about the future:
- Off: checking the file later needs the issuer's servers to still be running and answering.
- On: checking the file later needs only the file.
For an invoice that will be paid next week, off is fine. For a contract, a deed, a tender, an insurance policy, a qualification certificate (anything filed and forgotten) turn it on.
How to see whether a file has it
Open it with Verify PDF Signature. The status rows include Long-term validation, reading either Present (not checked) or Not included. "Present" means the evidence is in the file; whether every piece of it is complete is shown in the other rows.
Common questions
What does long-term validation (LTV) mean in a PDF?
It means the file carries its own proof: the certificates in the signer's chain and signed statements that none of them had been cancelled. A checker can confirm the signature from the file alone, even many years later.
Can a digital signature really expire?
The signature itself does not stop working. What can disappear is the evidence needed to judge it. The issuer's servers and the certificate's validity period. LTV preserves that evidence inside the file so the question can still be answered.
Why is the LTV box greyed out?
Because it needs a trusted timestamp. Stored evidence only means something alongside a reliable date, so turning the timestamp off also turns LTV off.
Why did my file say long-term validation could not be completed?
Because at least one certificate in the chain does not publish a way to check whether it was cancelled, or that service could not be reached. This is common with self-signed IDs and small in-house authorities. The document is still signed; it simply carries no stored evidence.
Does LTV make the file bigger?
A little. It adds the certificates and the cancellation responses, which are small compared with most documents.
Do I need LTV for an everyday form?
Usually not. It matters for documents that must still be provable years from now: contracts, deeds, filings and records you archive.