How to verify that timestamping is done correctly for signed code

Question

I have just got my code signing certificate from StartSSL and am trying to sign our installer.

The signing process goes well and I get an installer exe that Windows no longer complains about being from unknown publisher. This is great!

However I tried to make sure that the timestamping also works as advertised so I moved my PC date to 2012, after my code signing certificate expiration date.

This supposedly should not make any difference but when I run the same installer exe I now get the same nasty "unknown publisher" warning.

Looking at the properties of the exe in the Digital Signatures tab I can definitely see that the timestamp shows today (2010) but this does not seem to help at all.

Googling gave me nothing except that if you see the date in the Timestamp field then all is OK. I cannot believe this, my PC with advanced date complains that it is not OK.

Does anyone know if this timestamping concept works at all and how to make sure I am signing the executable correctly?

Thanks.

Answer 1

Sorry, I don't have an answer for you, but it does look like you shouldn't be seeing the behavior that you are, according to Comodo's Instant SSL FAQ.

Is timestamped code valid after a Code Signing Certificate expires?
Timestamping ensures that code will not expire when certificate expires. If your code is timestamped the digital signature is valid even though the certificate has expired. A new certificate is only necessary if you want to sign additional code. If you did not use the timestamping option during the signing, you must re-sign your code and re-send it out to your customers.

Comodo seems to be authoritative on this subject, so I'm inclined to believe what they say.

I'm anxiously waiting for the answer on this myself, because I'd very much like to purchase a code signing cert from StartSSL myself. I did notice on their site, that the code certs are 'beta' so maybe this is something they need to get the kinks worked out of.

Answer 2

There is a difference between the "Signing Time" and the Timestamp from the "Stamping Signer". The Signing time is the time when you actually signed the code, when the timestamp is from the "stamping signer" (the certificate server).

Signing with the certificate issuer timestamp will actually make sure that your signature is still valid even if your certificate already expired.

Answer 3

The code-signing certificates issued by StartSSL contain the enhanced key usage (EKU) attribute "Lifetime Signing" (1.3.6.1.4.1.311.10.3.13), which causes the file signatures to expire when the certificate expires, regardless of any timestamps.