A detached signature has no embedded document
CMS SignedData can omit the encapsulated content. In that case the signature is detached: the original document must come from elsewhere. This opener reports that no embedded document is present. It does not invent a PDF from certificate information, search the internet for a document or substitute an unrelated file with a similar name.
An attached empty payload is different from a detached signature. A real zero-byte content value can be extracted as an empty file, while a detached structure has no content value to extract. The report distinguishes these structural cases. Neither case by itself establishes a valid signature or explains why the source application created the package.
Encryption needs a separate capability
Encrypted CMS content is not ordinary SignedData extraction. Opening it requires an appropriate key and a compatible application. This tool identifies supported encrypted content types and reports that no decryption was attempted. It does not request private keys, passwords or certificates and does not claim that a failed extraction proves the document is damaged.
Similarly, the embedded document may have its own protection. A PDF can be extracted successfully while its preview still requires a password. Keep the unchanged download and open it through your trusted application. The outer container and the inner document can have different formats, protections and validation requirements.
Treat validation as a separate question
To validate a signature, software must check more than the presence of a signer-info entry. Relevant checks can include the signed content digest, cryptographic signature, certificate chain, trust anchors, revocation information and timestamp policy. This opener deliberately does not perform those checks or present a green verified-signer badge.
The extraction report states what was structurally read, which documents were obtained and which limits or unsupported cases occurred. It provides no identity assurance or legal opinion. Keep that report beside the original container and use a suitable signature-validation application when those conclusions matter. Successful preview, readable text and a familiar certificate name are not substitutes for that validation.