"This Message Has an Invalid Digital Signature" in Outlook — How to Fix It

Symptom fingerprint

The exact strings, error codes, and UI surfaces that map to this issue:

What Outlook is actually flagging

This is an S/MIME warning. Outlook took the sender's digital signature and tried to prove three things: that the message wasn't changed in transit, that the signing certificate chains to a root your computer trusts, and that the certificate is current and matches the sender's email address. If any of those fail, you get "invalid digital signature".

The word "altered" in the message scares people, but tampering is the rare case. Far more often it's a trust or certificate mismatch on the receiving machine — the email is genuine, your PC just can't vouch for it yet.

Why this happens

• The sender's certificate chains to a CA (or internal root) your machine doesn't trust.
• The signing certificate has expired or been revoked.
• The certificate's email address doesn't match the From address (common after someone changes their display or send-as address).
• Missing intermediate certificates, so the chain can't be built.
• The message really was modified in transit — occasionally a mailing list, gateway, or "safe links" rewrite breaks the signed content.
• Clock skew — your system time is off enough to put the certificate outside its validity window.

Step-by-step fix (Windows Outlook)

• 1. Open the message, click the red signature ribbon icon → Details → click the certificate to see exactly why it's failing (untrusted, expired, or name mismatch).
• 2. If it's a trust issue, get the issuer's root and intermediate certificates from the sender or their CA and import them: certmgr.msc → Trusted Root Certification Authorities (root) and Intermediate Certification Authorities (intermediates).
• 3. Confirm your Windows clock is correct (Settings → Time & language → Date & time → Sync now). A wrong clock alone can cause this.
• 4. If the certificate is expired, the sender must re-sign future mail with a current certificate — you can't fix an expired signature after the fact.
• 5. Restart Outlook and re-open the message.

Step-by-step fix (Outlook for Mac / New Outlook)

• Import the issuer's root/intermediate into Keychain Access → System, then set the root to "Always Trust" (double-click → Trust).
• Confirm the Mac's date and time are set automatically.
• Note that S/MIME support varies by Outlook version — the classic desktop clients handle it best; some new/lightweight builds have limited S/MIME verification.

Still not working?

• If details show a name mismatch, ask the sender to sign with a certificate issued to the exact address they send from.
• If a security gateway or "Safe Links"/"Safe Attachments" is rewriting mail, your admin may need to exclude signed messages from body rewriting — that rewriting is what breaks the signature.
• Verify the sender's certificate isn't revoked (their CA can confirm). A revoked certificate will always show invalid.
• For organization-wide failures, your IT/PKI team should push the required root and intermediate certificates through Group Policy.

You might also need

More fix guides in Email and related areas.