I am developing a library distributed as a Windows DLL to be called by 3rd party executables. I expect the calling EXE to be digitally signed and need to verify that.
I have no control over the computer on which my code will run. How do I validate if the calling executable is signed by a trusted, well-known CA such as Verisign or Symantec at the top of the certificate chain? I need to do this offline.
I have considered the following:
- Look for the strings "Verisign" and "Symantec" in the certificate subject.
- Compare certificate serial nos. against a list of serial nos. known to be valid.
- Compare certificate thumbprint against a list of known thumbprints.
However, I know that 1 and 2 can be spoofed. About 3, I am not sure about spoofing but how reliable is it when considering expiry and revocation?