I'm trying to understand the timestamp processing in the authenticode verification mechanism and it looks pretty simple, but I really do not understand how signature can be valid while both certificates (code and timestamp) are not in validity period.
Windows Authenticode Portable Executable Signature Format contains detailed description of processing authenticode, but there is no one case, when signature is valid after timestamp signing certificate has expired.
According to RFC3161, as soon as the certificate, used to sign a timestamp, expires, the timestamp becomes expired as well, so such timestamp should be re-done or notarized to renew the existing trust in this timestamp (does it mean certificate should be renew?).
Btw, what about software written ten years ago? Is there a mechanism to have infinite signature?