4 ms·
I think for code signing signatures, it's common to cache successful validation status beyond certificate expiration because it's not exactly easy to renew file
by fweimer 3y ago
I think for code signing signatures, it's common to cache successful validation status beyond certificate expiration because it's not exactly easy to renew file signatures. So things were fine with expired certificates until the revocation. For certain revocation events, you absolutely want to invalidate past signatures and cached validation status along with them. But maybe not for this one, hard to tell.
- mike_hearn 3y agoThe way it's meant to work is that the revocation date of a certificate is stored explicitly, and signatures are timestamped so you continue trusting signatures that pre-date that revocation date. Because that's supposed to be the moment the private key behind the cert became leaked or untrustworthy. However, Microsoft aren't doing this (their code signing ecosystem is frankly a mess compared to Apple's). Instead they're ignoring the timestamps in the signatures and breaking old binaries. Not cool.