What Is the Adobe Approved Trust List (AATL)? Reading Signatures in Acrobat
The Adobe Approved Trust List (AATL) is the list of certificate authorities whose certificates Adobe Acrobat and Acrobat Reader trust by default. It decides whether Acrobat shows a signature’s signer as trusted or as unknown, and it is why the same untouched PDF can get a different banner on different setups.
Open a digitally signed PDF in Acrobat and the bar across the top usually says one of three things: Signed and all signatures are valid, At least one signature has problems, or that the validity of a signature is unknown. Frontline staff tend to read anything short of the first as “fake.” Usually it isn’t. Usually it is a question of trust lists.
Two questions Acrobat asks
When Acrobat checks a signature, it asks two separate questions:
- Has the document changed since it was signed? Acrobat recomputes the file’s fingerprint and compares it with the one inside the signature. If they match, the signature panel says the document has not been modified since the signature was applied.
- Do I trust the certificate behind the signature? Acrobat follows the certificate up its chain to a root certificate authority and checks whether that root is on a list it trusts.
A signature can pass the first and not the second. Then Acrobat reports the validity as unknown and explains that the signer’s identity is unknown because the certificate isn’t in its list of trusted certificates. The file is intact. Acrobat simply hasn’t been told to trust whoever vouched for the signer.
What the AATL is
The AATL is Adobe’s answer to the second question. Certificate authorities and trust service providers apply to Adobe, which reviews them against its published technical requirements. These include keeping signing keys in protected hardware that prevents them from being copied or exported, and passing audits. Adobe adds the root certificates of those that qualify to the list, signs the list, and publishes it. Acrobat and Acrobat Reader download it and keep it up to date.
The effect is that a signature chaining to an AATL root is trusted in Acrobat anywhere in the world, with no setup on the recipient’s side. That is valuable when documents go to people you have never met: a bank’s back office, a foreign counterparty, a government records section.
What AATL recognition doesn’t mean
- It isn’t legal validity. In the Philippines, electronic signatures have legal effect under the Electronic Commerce Act (R.A. 8792), and the Rules on Electronic Evidence govern how they are proved. Neither mentions Adobe’s list.
- It isn’t notarization. A trusted signature proves who signed and that nothing changed. Notarization is a separate legal act by a commissioned notary, and it makes a private document public.
- It isn’t universal. The AATL governs Adobe’s software. A browser’s built-in PDF viewer may not check signatures at all, and other readers keep their own trust lists.
- An unknown signer isn’t a forged one. A signature whose certificate isn’t on the AATL can still be perfectly genuine.
How Twala documents appear in Acrobat
Every document completed on Twala is sealed with the Twala Platform Seal, a standard X.509 digital signature over the finished PDF, from Twala’s own certificate authority, with an RFC 3161 timestamp. Acrobat can always answer the first question for it: whether the file has changed since it was sealed. On a copy of Acrobat that hasn’t been set to trust Twala’s certificate, it may show the signer’s identity as unknown. That message is about Acrobat’s list, not about the document.
Twala’s verify page is the reliable check for every Twala document. It checks the certificate against Twala’s trust registry and traces the document’s fingerprint to its anchor on the Polygon blockchain, then returns Document verified or Document tampered.
For organizations that need Acrobat’s own recognition as well, Twala partners with a global certificate authority that holds AATL status, so Twala-issued signatures can inherit the trust list’s recognition through the partner CA. Organizations that prefer PKI-based digital signatures and seals can then have them verified against the AATL at the PDF level, in Acrobat itself. Enterprise plans also include a PKI digital seal for institutions with their own certificate requirements. To set this up for your organization, contact us.
What to tell your frontline staff
If your office receives digitally signed PDFs, a short routine prevents both false alarms and false comfort:
- Ask for the PDF itself. A printout or a scan is a picture of the document. The signatures only exist in the original file.
- Open the signature panel. If it says the document has been modified since signing, or that a signature is invalid, treat the document as altered.
- Don’t reject on “unknown” alone. If the document is unmodified but the signer is unknown, check the document another way before deciding.
- For Twala documents, use the verify page. Upload the PDF and read the verdict.
- Keep the original file. File the PDF itself, not a re-saved or printed copy, which would carry no signatures at all.
For what keeps those signatures checkable years from now, read long-term validation, explained. Recipients of notarized documents can also follow how to verify an eNotarized document.
Twala is a Supreme Court-accredited Electronic Notarization Facility (ENF). Adobe, Acrobat, and Reader are trademarks of Adobe. Other names are the property of their respective owners.
