I recently acquired a Microsoft Authenticode Code-signing certificate as a new certificate using an identical name to another one which will expire soon.

Obviously, the new certificate has no reputation attached to it, and will take some time and installs in order to be fully trusted.

My question is: If I sign an executable with both certificates, will the new one start building reputation?

I have already verified that the installer is trusted when it has both signatures.

  • 1
    "... the new certificate has no reputation attached to it,..." - Reputation is not propagated from one leaf certificate to another leaf certificate, i.e. your approach is wrong in general. The reputation does not come from the certificate itself but from who it was issued for (subject) and who issued it (issuer, i.e. the CA). None of this changes just because a certificate was renewed. – Steffen Ullrich May 31 '19 at 5:31
  • That's interesting. Technically, I think this is a 'new' certificate from Digicert, which has the same name on it (so I presumes the 'Subject' was identical). I ask the question because whatever the process was to get the cert, it doesn't have Reputation at the moment. – Daniel May 31 '19 at 6:05
  • Yes when your certificate is seen in the wild it helps your reputation (for things like Microsoft SmartScreen). However I think most of the time it depends on the actual binary and it’s prevalence. – eckes May 31 '19 at 8:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.