By "validate", I mean the same as Windows Explorer (or "signtool verify /pa") does: compute the file digest and verify that it's the same as the one stored encrypted in the signature, and check the chains of trust of the signature certificate and the timestamp. I'm working on a briefing about what digital signatures can and can't do, and the AppLocker documentation on the Microsoft website seems to be silent on this detail.

I know that AppLocker can take details from the Authenticode signature for a Publisher rule. That's explained clearly. I know that AppLocker can compute file hashes itself, and that those are used in file hash rules. But I can't find anything that tells me unambiguously about validating the Authenticode signature.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.