Welcome to the Lounge

Sandeep Mewara10-Oct-20 9:46

Sandeep Mewara

10-Oct-20 9:46

AFAIK - it will have an impact. Your certificates has a defined validity. As long as it's valid, your signature is. Once the certificate expires, your exe will go into insecure exe zone and anti-viruses might start flagging it up.

So, your previously signed application can install successfully on client system at the mercy of antivirus systems. (mostly would flag it because of expired certificate, keeping security as priority unless they have enough data in their database to confirm it is an okay executable)

Latest CodeProject post: Data Visualization - Insights with Matplotlib
To read all my blog posts, visit: Learn by Insight...

Southmountain10-Oct-20 11:18

Southmountain

10-Oct-20 11:18

my new goal is to install a driver program onto client machine. after it is signed and installed on client machine successfully, what will happen
after my certificate expires, will that driver program still work?

this is the question bugging me and I can not validate it now...

diligent hands rule....

Gary R. Wheeler10-Oct-20 10:54

Gary R. Wheeler

10-Oct-20 10:54

You should go back to the authority where you purchased the certificate and review the terms with them.

That said, the 'code signing' business is a lovely racket. At regular intervals a weakness is discovered in the certificate mechanism, at which time all current owners are given a [fairly short] interval during which they must purchase a new certificate to indicate their software is 'valid'. If they fail to update their certificate, their software is invalidated.

There is little difference between you the developer and the certificate authority, and the thug with a Glock in the mini-mart wanting this week's $500.

Software Zen: delete this;

raddevus10-Oct-20 11:03

10-Oct-20 11:03

I looked into this a while back since I had written a winforms app I wanted to be known as safe.
I came to the same conclusions -- that it is hardly realistic with all the work you have to do plus the $$$.

But here's the really interesting thing...
You can create an installer that will install an ElectronJS complete app (or a NodeJS app) that runs natively on the user's desktop and has extended abilities and Windows will not flag that app at all. It will simply install without every complaining or making any antivirus aware.
Most users would never know the difference between the Electron app and a normal Windows app either.
So, the system is kind of broken that way too.

Shao Voon Wong10-Oct-20 15:14

Shao Voon Wong

10-Oct-20 15:14

If you want your executable and installer to work after expiry, you have to sign it with a timestamp from one of the timestamp website with /tr switch before its expiry. In my case, I use timestamp.digicert.com

signtool.exe sign /tr http://timestamp.digicert.com /f Cert.pfx /p password /n "Put Your Name Here" /d "Put Your Description Here" YourApp.exe

RickZeeland10-Oct-20 19:26

RickZeeland

10-Oct-20 19:26

If it is an Authenticode certificate you can find the expiry date somewhere in the file properties, it is hard to find btw.

dandy7211-Oct-20 4:22

dandy72

11-Oct-20 4:22

As others have pointed out, it's not that an expired cert means the signature is suddenly "no longer valid", but apps that might care to do anything about it will flag exactly that, an expired cert.

To me that ranks the same as "won't somebody PLEASE think of the children?" What did we ever do with our EXEs before anything ever got signed?

harvyk011-Oct-20 19:44

harvyk0

11-Oct-20 19:44

I don't know if that last comment was tongue-in-cheek or not, but anyway....

Well once upon a time you needed to get exe's from floppy disks (and then later CD's) from a physical software shop. Whilst yes it was possible that the exe on a floppy disk was modified by a intermediate person, you could be pretty sure that it was a genuine program (unless you lived on "sneaker-net" software)

When the internet came around you had to rely on the fact that something calling itself "Microsoft Software" really did come from Microsoft. Whilst yes, I can get a certificate and release Trojans, it's one more step I would need to do to look "trustworthy". And I'd probably have a great deal of difficulty getting a (non-self-signed) certificate calling myself "Microsoft Software"

patbob12-Oct-20 14:36

patbob

12-Oct-20 14:36

harvyk0 wrote:
And I'd probably have a great deal of difficulty getting a (non-self-signed) certificate calling myself "Microsoft Software"

Absolutely you would, otherwise the concept of code signing would be worthless. Getting that certificate requires that the CA verify you are who you say you are.

harvyk0 wrote:
Whilst yes, I can get a certificate and release Trojans, it's one more step I would need to do to look "trustworthy".

Not just one more step, they make it hard for you to avoid giving your real identity to them before getting the signing certificate. If you intentionally sign bad stuff, they know where you live. Also, they can revoke your signing authority, so everything you've ever signed with that certificate is no longer valid -- users who try to install it get a certificate-revoked error -- and you can't sign anything new with it either. It takes time for revocations to filter through the system, and they are very few and far between, but they do happen.

5G -- more lies faster.

harvyk011-Oct-20 19:56

harvyk0

11-Oct-20 19:56

We use them for our software. At most you'll get a warning that the certificate has expired. Windows will not stop software running with invalid or expired certificates (at least this was the case a couple of years ago when I tested that by modifying the exe using a hex editor after signing).

To some of the others questioning code signing certificates:
They are very useful for Whitelisting applications such as AppLocker, as it allows you to trust an entire suite of applications / updated versions of software by the same vendor without needing to simply trust things based on path / file names (technically insecure unless you've got strong permissions) or hash based (where typically every file needs to be hashed and certainly every version update).

Also the comment for getting java (or variants like that) to simply run remotely without signing (or unsigned alerts), an appropriately hardened machine will prevent that from happening (talking corp environment here).

Still amazed when tech works: partition expand

Stepan Hakobyan11-Oct-20 20:06

Stepan Hakobyan

11-Oct-20 20:06

The old signed exe will be alright, and will work if its compatible on the machine/OS.
But you will not be able to properly sign new exes with the old certificate.

raddevus10-Oct-20 7:02

10-Oct-20 7:02

My system was dual boot Win10/Ubuntu.
Today I decided to expand my Ubuntu partition and delete win10 and only run win10 from VirtualBox.

1) I got Win10 installed and registered from VBox. Can't believe it worked perfectly.
2) I had to delete the old win10 partition and then resize the Linux partition to take over the entire drive.

There were tenuous moments as gparted expanded / copied the partition.
I rebooted and it worked.
Can't believe it when tech works!! Roll eyes | :rolleyes:

OriginalGriff10-Oct-20 7:41

OriginalGriff

10-Oct-20 7:41

I know the feeling - I've used AOMEI Partition Assistant (the free version) to change the size of my boot partition, and ... it just worked, even with windows 10 running.

I had a good backup, but ... I had my fingers crossed when I pushed the "go for it" button.

Impressive stuff, technology!

"I have no idea what I did, but I'm taking full credit for it." - ThisOldTony
"Common sense is so rare these days, it should be classified as a super power" - Random T-shirt
AntiTwitter: @DalekDave is now a follower!

raddevus10-Oct-20 8:48

10-Oct-20 8:48

OriginalGriff wrote:
I had a good backup, but ... I had my fingers crossed when I pushed the "go for it" button.

That's exactly how I felt when I rebooted the first time.
I had read the warnings that "sometimes grub won't find the partition and I was scared.

Glad you had success too! Thumbs Up | :thumbsup:

it's a great feeling.

davecasdf12-Oct-20 4:27

davecasdf

12-Oct-20 4:27

I think I'm 3 for 4, several just worked ( gparted ) one damaged the ( NTFS ) partition. ( NOT as badly as checkdisk has done on several times. ) That was on a "backup" machine, so no huhu.

RickZeeland10-Oct-20 7:43

RickZeeland

10-Oct-20 7:43

You are a real influencer!
(and a daredevil)
$Shucks | :-\$

raddevus10-Oct-20 8:50

10-Oct-20 8:50

RickZeeland wrote:
You are a real influencer!
(and a daredevil)

Thanks, I really was hoping to encourage others toward success, because when I finally decided to go for it and I pulled the trigger I thought, "I'll probably be working on getting my system to boot all day long, but I guess that's what computers are all about".
It's very encouraging to have something actually work. Big Grin | :-D

Peter_in_278010-Oct-20 16:03

Peter_in_2780

10-Oct-20 16:03

If you want a real adrenaline rush, move and shrink your root partition with Gparted.
I've done it a couple of times and survived.

Cheers,
Peter

Software rusts. Simon Stephenson, ca 1994. So does this signature. me, 2012

raddevus11-Oct-20 5:28

11-Oct-20 5:28

Peter_in_2780 wrote:
move and shrink your root partition with Gparted.

Yeah, sounds too scary for me. Smile | :)

Glad to hear it worked out for you. Thumbs Up | :thumbsup:

theoldfool11-Oct-20 1:16

theoldfool

11-Oct-20 1:16

Another black box that has served me was Boot Repair. Fixed a boloxed up Grub (self inflicted).

As Pogo said: "we have met the enemy and it is us"

If you can keep your head while those about you are losing theirs, perhaps you don't understand the situation.

raddevus11-Oct-20 5:30

11-Oct-20 5:30

theoldfool wrote:
Boot Repair.

I will keep that in mind for the future.
I had a problem with grub on another dual boot-- trying to remove the dual boot options and somehow I finally worked thru it but it was touch and go for awhile where the laptop did nothing but show the initial boot menu.

theoldfool wrote:
As Pogo said: "we have met the enemy and it is us"

So true! Most all the problems I have are self-inflicted by trying to do something else. Laugh | :laugh:

dandy7211-Oct-20 4:15

dandy72

11-Oct-20 4:15

raddevus wrote:
1) I got Win10 installed and registered from VBox. Can't believe it worked perfectly.

By now I'm much more confident seeing Windows 10 working in a virtualized environment than on real hardware. I've seen a few botched upgrades firsthand, and it was always with real hardware - never a VM. I'm absolutely convinced Microsoft tests a lot more instance of Windows 10 as VMs than on real hardware.

raddevus wrote:
Can't believe it when tech works!!

When a tool's sole job is to do exactly the one thing you're trying to accomplish...you have to have more faith than that. Otherwise why would anyone ever take a chance?

raddevus11-Oct-20 5:32