Code Signing for Vista with GoDaddy Certificates

Question

We recently purchased a Code Signing certificate from GoDaddy. Following their instructions, we were able to use the SignTool from MS and sign our installer. When installing under XP, this works great.

However, when installing under Vista, if we look at the certificate, it is saying "One of the countersignatures is not valid. The file may have been altered." and the Certificate Information shows "The timestamp signature and/or certificate could not be verified or is malformed."

This is on Vista 32-bit and 64-bit. Again, no issues in XP.

Any ideas?

Answer 1

I'm just guessing here, but looking at some signed code on my XP box I see that the timestamp certificate chain is distinct from the code signing certificate chain. It is possible that the roots for both chains are trusted for both purposes on XP but only one of those chains is valid on Vista.

Answer 2

I'm assuming it is Kernel-Software that requires a Kernel-Mode certificate. It seems like the time stamp is optional when creating the certificate with GoDaddy. Make sure that a time stamp is included.