What steps should I take to make sure that the certificate of a file can be trusted. Or is there really a way to be absolutely sure about that?
I am currently implementing this validation using the WinAPI. The validation of a file's digital signature is done using WinVerifyTrust. As the certificate verification, I am extracting all the information about the certificate (like its thumbprint, all root CAs, etc.). However, I don't know how to use it to verify its authenticity.
Any other tips and information about verifying the digital signature and certificate of a file is appreciated.