3 ms·
Binaries are timestamped though. If you sign it, it's practically valid forever (unless you revoke the signature).
by notpushkin 3y ago
Binaries are timestamped though. If you sign it, it's practically valid forever (unless you revoke the signature).
- Avamander 3y agoIt takes more than the signing date to assert validity at the time of signing rather than at the time of checking. This means that these signatures tend to expire when the code signing certificate or the CA itself expires.
- electroly 3y agoThat's why you get a timestamp countersignature; that's what the person you're replying to is talking about. They are absolutely correct. This is standard practice. Signed executables on Windows DO NOT lose trust when the certificate expires as long as they are cryptographically timestamped. https://learn.microsoft.com/en-us/windows/win32/seccrypto/time-stamping-authenticode-signatures https://learn.microsoft.com/en-us/windows/win32/seccrypto/ti... My first code signing certificate from long ago is already expired; the signed executables under that certificate are still trusted by Windows.