2 ms·
No, it doesn't need to chain to a trusted root. Any signature silences a whole class of errors. You can also do strict enforcement if you'd like but the last I
by R0b0t1 6y ago
No, it doesn't need to chain to a trusted root. Any signature silences a whole class of errors. You can also do strict enforcement if you'd like but the last I looked at this it's not the default.
- GordonS 6y agoDigital signatures absolutely do need to chain to a trusted root (also, I forgot to mention that the certificate also has to have the "digital signature" EKU). What errors do you believe are silenced when an executable has an invalid or untrusted signature?
- R0b0t1 6y agoFrom memory adding a valid but unchained signature to a binary will change how SmartScreen initially evaluates your application. If there's no signature at all you get a yellow box or at least a message that is more alarming than if there is a valid signature even if unrecognized. Similar thing for the script signing policies -- during my testing the default seems to want a signature, but not a valid chained one. I was confused in the same way you are, but the documentation doesn't actually say you need a valid chained signature nor does it really describe the threat and security models. They just have signatures, because signatures make things more secure, right?
- GordonS 6y agoApologies, I was thinking of Windows installers, rather than executables - a warning is given for installers with an invalid or untrusted signature, but you were correct that no warning is given for executables.