4 ms·
> Revoke certificates for old compromised versions of an installer so that downgrade attacks are not possible. Worth noting that Windows accepts signatures fro
by iancarroll 4y ago
> Revoke certificates for old compromised versions of an installer so that downgrade attacks are not possible.
Worth noting that Windows accepts signatures from revoked code signing certificates so long as it has a signed timestamped before the revocation.
- hamandcheese 4y ago….and I assume the revocation can’t be back-dated?
- ComputerGuru 4y agotimestamps must come from a globally recognized signed source, like digicert or verisign.
- iancarroll 4y agoThe CA could backdate the CRL’s revocation timestamp if they wanted, but it seems unlikely and presumably it’s not allowed.