Questions tagged [authenticode]
Microsoft Authenticode is a signing technology used to apply digital signatures to software. It is used to provide author information and prevent modification of executables, including drivers.
7 questions
8
votes
5
answers
2k
views
When Code Signing, what is the point of enhanced security specifically for the private key itself?
TL;DR
What is the point of having hardware based HSM/FIPS based protection for the private key when the ability to sign is "only" protected by credentials / API keys?
Background
In the past, ...
- 1,519
2
votes
1
answer
614
views
Should my executable check that it has been signed with my certificate
We distribute a Windows application. The application is code signed with a certificate from a proper/trusted CA. This provides some guarantee that the application came from us (checked by the OS).
We ...
- 121
2
votes
0
answers
388
views
Windows CSP for remote signing
I have a system (lets call it signer) that has private keys for doing Authenticode code signing. I have bunch of build systems that want to sign generated build artifacts. Obviously I can't use ...
- 121
0
votes
0
answers
164
views
Switching CSC certificate issuer and SmartScreen
We have most of our SSL certificates hosted at GoDaddy but have Standard Code signing certificate from GlobalSign, we would like to switch to GoDaddy CSC since our CSC from GlobalSign is expiring in 3 ...
- 101
22
votes
4
answers
11k
views
Transferring Microsoft SmartScreen reputation to renewed certificate
I know that even a software signed with a new code signing certificate triggers Microsoft Defender SmartScreen warning:
Windows Defender SmartScreen prevented an unrecognized app from starting
The ...
- 523
2
votes
2
answers
908
views
Can I sign with two Code Signing certs to build reputation on the newer one?
I recently acquired a Microsoft Authenticode Code-signing certificate as a new certificate using an identical name to another one which will expire soon.
Obviously, the new certificate has no ...
- 21
2
votes
2
answers
3k
views
Are all fields of the PE certificate directory hashed during authenticode signing?
In a Windows portable executable (PE) file the certificate directory points to an offset to a WIN_CERTIFICATE structure. My understanding is that while the field is named bCertificate, it actually ...
- 136k