2

I recently acquired a Microsoft Authenticode Code-signing certificate as a new certificate using an identical name to another one which will expire soon.

Obviously, the new certificate has no reputation attached to it, and will take some time and installs in order to be fully trusted.

My question is: If I sign an executable with both certificates, will the new one start building reputation?

I have already verified that the installer is trusted when it has both signatures.

Improve this question
3
  • 2
    "... the new certificate has no reputation attached to it,..." - Reputation is not propagated from one leaf certificate to another leaf certificate, i.e. your approach is wrong in general. The reputation does not come from the certificate itself but from who it was issued for (subject) and who issued it (issuer, i.e. the CA). None of this changes just because a certificate was renewed.
    – Steffen Ullrich
    May 31, 2019 at 5:31
  • That's interesting. Technically, I think this is a 'new' certificate from Digicert, which has the same name on it (so I presumes the 'Subject' was identical). I ask the question because whatever the process was to get the cert, it doesn't have Reputation at the moment.
    – Daniel
    May 31, 2019 at 6:05
  • Yes when your certificate is seen in the wild it helps your reputation (for things like Microsoft SmartScreen). However I think most of the time it depends on the actual binary and it’s prevalence.
    – eckes
    May 31, 2019 at 8:42

2 Answers 2

Reset to default
1

I am experimenting myself with 2 certs right now. To add a second code signing cert I use /as key of my signtool v8.1.

I figured out that the order how you sing your EXE file with your certs leads to different results:

  1. If I sign my Exe file with Old, then New certs then SmartScreen doesn't complain (but I am not sure if your new cert gets any rep).
  2. If I sign my Exe file with the New cert and then with your Old cert then SmartScreen shows its blue window where the user should click More / Run Anyway. But after that step the installation works well and Windows or antivirus software doesn't complain.
Improve this answer
0

I understand that if you have an extended validation (EV) certificate then Microsoft can see the link between old and new and reputation is maintained.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .