0

Does Windows 11 need to make a network connection to verify a code signature for a .exe or .dll file?

2

2 Answers 2

2

No, the signatures are validated against the root CA certificates included with the operating system.

In practice it might also make outgoing connections to check for certificate revocations, or to query other value added services like anti-virus or reputation checking, but these are not necessary just to validate the signature.

1

I know you are specifically asking about Windows 11, but I thought the following information was worth mentioning anyway.

The Internet might be needed if the root certificate of the signature is not already present on the computer. Back in 2012, Windows did have a mechanism to download trusted root certificates from the Internet, but it didn't always work reliably. Here is my old forum thread where I asked for help getting it to work.

From Microsoft:

The Update Root Certificates Feature in Windows Vista

The Update Root Certificates feature in Windows Vista is designed to automatically check the list of trusted authorities on the Windows Update Web site when this check is needed by a user's application. Specifically, if the application is presented with a certificate issued by a certification authority in a PKI that is not directly trusted, the Update Root Certificates feature (if it is not turned off) will contact the Windows Update Web site to see if Microsoft has added the certificate of the root CA to its list of trusted root certificates. If the CA has been added to the Microsoft list of trusted authorities, its certificate will automatically be added to the set of trusted root certificates on the user's computer.

The Update Root Certificates feature can be turned off in Windows Vista by using Group Policy. For more information, see "Procedures for Viewing or Changing Group Policy Settings that Affect Certificates in Windows Vista," later in this section.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .