Timeline for Transferring Microsoft SmartScreen reputation to renewed certificate
Current License: CC BY-SA 4.0
27 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 6, 2023 at 14:29 | answer | added | Andreas Löw | timeline score: 1 | |
| Jul 10, 2021 at 18:44 | comment | added | stefansundin | I have recently learned that it is possible to dual-sign binaries, which I think is intended to be used to sign with both SHA-1 and SHA-256. Does anyone know if it is possible to dual-sign with two different certificates? Would that possibly help to transition to a renewed certificate (before the old one expires, of course). If anyone has tried this then please let me know. Thanks! | |
| Jul 2, 2021 at 19:33 | answer | added | MaxSh | timeline score: 2 | |
| Mar 28, 2021 at 7:33 | comment | added | emkey08 | @MechMK1 No, the reputation isn't transferred, even if the renewed certificate has the same public key. I've renewed my certificate in Jan 2021, using the same certificate signing request (CSR) as last time, and still SmartScreen started complaining again afterwards. Also see my answer stackoverflow.com/a/66582477 for details. | |
| Sep 30, 2020 at 11:19 | history | edited | Martin Prikryl | CC BY-SA 4.0 |
added 224 characters in body
|
| Sep 8, 2020 at 9:52 | history | edited | Martin Prikryl | CC BY-SA 4.0 |
added 7 characters in body
|
| Sep 8, 2020 at 9:30 | comment | added | Basj | @JozefIzso Only ~ 10 people is enough such that future customers won't see it again? | |
| Mar 2, 2020 at 20:17 | comment | added | browsermator | We found that as long as you submit the application for certification the reputation will carry over. It won't matter that there is a new certificate: docs.microsoft.com/en-us/windows/win32/win_cert/… | |
| Mar 2, 2020 at 11:35 | vote | accept | Martin Prikryl | ||
| Jan 7, 2020 at 20:55 | answer | added | LTPCGO | timeline score: 3 | |
| Jan 7, 2020 at 8:14 | comment | added | Martin Prikryl | @JozefIzso About one month after a release, the SmartScreen message stopped showing. But now we have released a new version of the software signed with the same certificate and it shows the message again. Is that expected? I expected that the message will be gone for good. Thanks. | |
| Jan 1, 2020 at 9:08 | answer | added | Martin Prikryl | timeline score: 10 | |
| Dec 5, 2019 at 9:37 | comment | added | Jozef Izso | Yes, we must use the software internally long enough so customers do not face the SmartScreen information. Usually we don't see it after few days when up to 10 people use it. | |
| Dec 3, 2019 at 6:20 | history | edited | Martin Prikryl | CC BY-SA 4.0 |
added 8 characters in body
|
| Dec 2, 2019 at 21:39 | comment | added | Petr | More here... blogs.msdn.microsoft.com/ie/2012/08/14/… However, how long does it take to build reputation for a new certificate? | |
| Dec 2, 2019 at 21:38 | comment | added | Petr | "...SmartScreen builds reputation for both individual programs and for the certificate used to sign that code. Code signing is important to our reputation intelligence because this higher level identity allows us to build reputation across multiple programs signed by a publisher. It is also important for publishers because signed programs inherit the reputation of the certificate with which they are signed; this means every program a publisher distributes doesn’t need to build reputation individually." | |
| Dec 2, 2019 at 21:11 | history | edited | Martin Prikryl | CC BY-SA 4.0 |
added 28 characters in body
|
| Dec 2, 2019 at 18:41 | history | edited | Martin Prikryl | CC BY-SA 4.0 |
added 3 characters in body
|
| Dec 2, 2019 at 16:22 | history | edited | Martin Prikryl | CC BY-SA 4.0 |
deleted 1 character in body
|
| Dec 2, 2019 at 13:43 | history | edited | Martin Prikryl | CC BY-SA 4.0 |
added 10 characters in body
|
| Dec 2, 2019 at 13:16 | comment | added | Jozef Izso | It takes few weeks while we use our internal builds and no longer than month. | |
| Dec 2, 2019 at 12:00 | history | tweeted | twitter.com/StackSecurity/status/1201471185336389632 | ||
| Dec 2, 2019 at 11:40 | history | edited | Martin Prikryl | CC BY-SA 4.0 |
added 22 characters in body
|
| Dec 2, 2019 at 11:30 | comment | added | Martin Prikryl | @JozefIzso Thanks for your comment. And how long does it take to build it? | |
| Dec 2, 2019 at 11:26 | comment | added | Jozef Izso | We face this situation each time we renew our Authenticode certificate. Without EV, you must build the reputation from the scratch. | |
| Dec 2, 2019 at 9:40 | history | edited | Martin Prikryl | CC BY-SA 4.0 |
added 8 characters in body
|
| Dec 2, 2019 at 8:58 | history | asked | Martin Prikryl | CC BY-SA 4.0 |