Does iText automatically validate digital signatures when opening a PDF?

No. iText Core does not automatically validate digital signatures when a PDF is opened. Simply loading a document with PdfDocument/PdfReader does not verify signature integrity or certificate chains, and does not reject a document merely because its signatures are invalid or missing.

A successfully loaded PDF must therefore not be assumed to be authentic, unmodified, or signed by a trusted party. Opening a document with an invalid or forged signature without explicitly validating it is expected behavior and is not, by itself, a security vulnerability.

Applications that rely on signatures must validate them explicitly using the sign module of iText Core, for example with ValidatorChainBuilder and SignatureValidator, according to their own trust policy. Applications must also decide how to handle documents that fail validation, produce an indeterminate validation result, or lack required signatures.

For implementation guidance, see Signature Module Refactoring & Built-in Signature Validation API. For policy details, see iText Signature Validation Policy Details.