# ASiC-E Signature Validator: what the results mean

> An ASiC-E signature validator does not simply answer yes or no. There are four possible results, and the one in the middle causes the most confusion.

Source: https://asiceviewer.com/en/blog/asice-signature-validator/
Published: 2026-11-10 · Digixy

## In short

- Valid: every check passed.
- Valid with warnings: legally fine, with a technical remark.
- Invalid or unknown: do not rely on the signature until the cause is understood.

## The four results

| Result | Meaning | Can you rely on it? |
| Valid | Integrity, signature value, trust chain and revocation all passed | Yes |
| Valid with warnings | Passed, but something deviates from current best practice | Usually yes; read the warning |
| Invalid | At least one essential check failed | No |
| Unknown / indeterminate | The validator could not complete a check | Not until resolved |

## Typical reasons for warnings

- **Weak algorithm.** Older containers use SHA-1 digests. The signature was fine when made; the algorithm is no longer recommended.
- **Old format.** A DDOC or early BDOC file is flagged because the format is outdated.
- **Extra or unsigned files.** Something in the container is not covered by the signature.
- **Time gap.** Signing time and time stamp are further apart than expected.

## Typical reasons for invalid

- **A file was changed.** The digest no longer matches. Often accidental: someone opened a document from the container and pressed Save.
- **A file is missing.** The container was repacked without one of the documents.
- **The certificate was revoked or expired** before the time stamp.
- **A test certificate was used.** Signatures made with test identities are not trusted.
- **The signature value does not verify.** The container is corrupt or forged.

## Typical reasons for unknown

The validator could not reach a revocation service, the issuer is not on the trust list the validator uses (common with certificates from outside the EU), or the container has no time stamp and the certificate has since expired.

## What a viewer adds before validation

Many invalid results are integrity problems, and those are visible immediately in a viewer. [ASiCE Viewer](https://asiceviewer.com/en/#tool) names the file that changed or went missing, which usually explains the cause faster than a validation report: ask the sender for the original, unmodified container.

## What to do with each result

1. **Valid:** archive the container.
2. **Valid with warnings:** read the warning; for old files consider re-time-stamping to preserve evidential value.
3. **Invalid:** request the original file again or a new signature.
4. **Unknown:** validate again later or with another validator, and ask the signer which identity scheme was used.

A validator's tools are listed in [ASiC-E validation tool](https://asiceviewer.com/en/blog/asice-validation-tool/). For reading containers on a phone before validating, there is the [Android app](https://play.google.com/store/apps/details?id=com.digixy.asiceviewer&hl=en&referrer=utm_source%3Dasiceviewer.com%26utm_medium%3Dblog-md).

## Frequently asked questions

**Is "valid with warnings" legally valid?**

Generally yes. The warning points to a technical weakness, not to a failed signature. Read the warning text to decide whether action is needed.

**A signature was valid last year and is unknown now. Why?**

Most likely it lacks embedded revocation data and the certificate has expired, so the validator can no longer confirm its status.

---

Open your .asice file now: https://asiceviewer.com/en/
ASiC-E Viewer on Google Play: https://play.google.com/store/apps/details?id=com.digixy.asiceviewer