I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to get the exact same response for the Digital Signature Information section in the tab. However, I'm unable to get the exact same response for the certificate chain, and certificate statuses.
Case in point;
I have 2 pe files on my computer for testing. When i check the Digital Signatures tab;
File1 has a status of This digital signature is not valid
File1's signing certificate is expired, and it marked as expired in the tab. (Valid until 10.01.2013)
File1's signing time is 13.04.2012
File1 has a timestamping certificate, which is also expired and marked as expired in the tab. (Valid until 25.10.2012)
It seems to me the timestamping logic is not performed on File1. Even though the signing date is before the expiration date of both certificates, certificate status is shown as expired. Lets have a look at File2.
File2 has a status of This digital signature is not valid
File2's signing certificate is expired, but it is marked as CERT OK in the tab. (Valid until 18.12.2012)
File2's signing time is 04.04.2011
File2 has a timestamping certificate, which is also expired and marked as CERT OK in the tab. (Valid until 15.06.2012)
Now, what i understand from this scenario is that File2' certificates are not marked as expired, because the timestamping logic is performed on these certificates, and I think this is the correct result. However, even though the same conditions apply to the File1, the timestamping logic seems to be ignored on this file, and certificates are shown as expired.
What is the difference between these files? Am i missing something?
I also did check the szOID_KP_LIFETIME_SIGNING 18.104.22.168.4.1.322.214.171.124 flag in the certificates, but i did not encounter it. Maybe i'm looking the wrong place for this flag? Where exactly is this flag lives?
I did follow some instructions from this link:https://stackoverflow.com/questions/329396/what-happens-when-a-code-signing-certificate-expires