When would a Authenticode signature expire?

Question

I'm curious about how Windows check the Authenticode signature.

For example, I would sign test.exe

I know that if test.exe doesn't have a TS (timestamp) signature from a TSA (Timestamp Authority), the signature would expire after the certificate's NotAfter datetime.

I used to believe that if test.exe have a Authenticode signature with a valid TS signature, this signature would expire after the TS certificate expire.

However, it seems I'm wrong... When I was cleaning my old computer, I found the PlantsVsZombie!（⊙o⊙） You can download the main file from here ( I'm not sure how long can I keep this link available... )

Its signing certificate expired at 2012/9/21 and its timestamp certificate expired at 2012/6/15. Both of these two certificates expired now. But surprisingly, its signature is still valid (Checked using Powershell command Get-AuthenticodeSignature and viewed from the attributes-Signature tab)

Then I wonder will a signature with timestamp expire? If it would, at which time?

Answer 1

I'm curious about how Windows check the Authenticode signature

Microsoft's Authenticode is a mechanism that is based on PKI as any other digital certificate verification process:

• Public key verification
• Certificate lifespan
• Certificate status (revoked?)
• Trust chain
• Timestamp (if used)

In case of timestamp, the signature will be valid as long as the certificate is valid. Otherwise, it will expire when the certificate does.

From DigiCert:

Timestamping ensures that code will not expire when the certificate expires because the system validates the timestamp. If you use the timestamping service when signing code, a hash of your code is sent to the timestamp server to record a timestamp for your code. A user’s software can distinguish between code signed with an expired certificate that should not be trusted and code that was signed with a Certificate that was valid at the time the code was signed but which has subsequently expired.