This certificate has an invalid digital signature

Question

I am trying to learn securing wcf service using ssl. I found this website and I am following the steps. http://robbincremers.me/2011/12/27/wcf-transport-security-and-client-certificate-authentication-with-self-signed-certificates/. But when came to creating certificate step I had an issue. Using below to create a certificate.

makecert –pe –n “CN=localhost” –sr localmachine –ss my –sky exchange

By default, the makecert utility creates certificates whose root authority is "Root Agency". For some reason, my Root Agency cert has become corrupted (invalid digital signature). How can I restore a valid Root Agency cert?

The site says when I create a certificate using above statement and double click on it I should see this

But I am seeing this:

So even If I add Root Agency to trusted root certificate authority it doesn't make any sense.

Other screenshot from my guide site:

And I have

How can I fix "This certificate has an invalid digital signature" issue?

Answer 1

This could be due to the length restrictions on certificate keys.

Microsoft enforced a minimum key length limit of 1024 bits in August 2012. Check that your self signed cert is created with a key length of at least 1024 bits.

For more info you can check out this blog post What does the “This certificate has an invalid digital signature.” message actually mean?

You can specify the key length when creating the cert with by using the -len parameter like so:

makecert -pe -ss MY -$ individual -n "CN=your name here" -len 2048 -r

Answer 2

you can run following command in a command prompt (with administrative rights):

certutil -setreg chain\minRSAPubKeyBitLength 512

this will set back the required key length (less secure!)

see https://morgansimonsen.wordpress.com/2013/05/30/what-does-the-this-certificate-has-an-invalid-digital-signature-message-actually-mean/ for more information.

quote from this website:

The reason is to be found in the Public Key Length field. In this certificate the public key is only 512 bytes. In August of 2012 Microsoft released an update that will block any certificates with RSA keys less than 1024 bits in length. This was done to make sure that a private key cannot be discovered using brute force methods and thus exposing private information. After the update the CryptoAPI, which builds a certificate trust chain and validates that chain by using time validity, certificate revocation, and certificate policies (such as intended purposes), implements an additional check to make sure that no certificate in the chain has an RSA key length of less than 1024 bits. Any such certificates will not be trusted. Actually the error displayed by Internet Explorer; “The security certificate presented by this web site is not secure” makes more sense than the messages in the certificate properties (“This certificate has an invalid digital signature”). Because that is actually what is happening; the certificate is not good enough to protect whatever data your are transmitting between the client and the server. So how come, according to the CryptoAPI extension, the digital signature is not valid? In public key cryptography the private key is generated from the public keys, or rather, the very large prime numbers selected to be the public key. That means that if the public key is weak, i.e. less than 512 bytes, the resulting private key would be as well. Since it is the issuing authority’s private key that is used to sign the issued certificate the signature itself would also be weak. And that is why the CryptoAPI displays the message “This certificate has an invalid digital signature”. What it should have displayed is something along the lines of “this certificates was signed with a weak private key etc.”. If you are desperate to use certificates with key lengths less than 1024 bits you can override the restrictions imposed by the Microsoft update. How to do that is documented in the KB article accompanying the update. Here is the command I ran to test that I was on the right track and force IE to let me use the certificate.