3 ms·
I'm not an expert on code signing, but wouldn't a code-signing cert with a 2 year lifetime mean that none of the apps it signs can be used for more than 2 years
by hamburglar 5y ago
I'm not an expert on code signing, but wouldn't a code-signing cert with a 2 year lifetime mean that none of the apps it signs can be used for more than 2 years? Or is the code-signing valid as long as the signature was generated within the signing cert's lifetime?
- marcan_42 5y agoThe latter. Code signing relies on a timestamping service to certify that the signature was made within the certificate's lifetime.
- zinekeller 5y agoThat assumes that the time-stamping certificate isn't revoked (not expired, revoked). Code signing is a mess.
- corty 5y agoSame problem as for document signatures, one needs a trustworthy timestamping service certifying the time of signature, so the client may check if the whole certificate chain might have been valid at the time. This means that you need far more extensive CA and revocation databases than for TLS, because you need to keep all that historical data.