0

I am applying for a new code signing certificate and I specified to the CA I need a certificate that will be time stamped such that any assembly signed during the valid date range will still execute even beyond that date range. They sent a template for creating the CSR containing OID=1.3.6.1.5.5.7.3.3

Does this value mean the certificate will be time stamped as I requested? A 10 year old stackexchange post indicates the RFC 3161 correct OID for time stamping is 1.3.6.1.5.5.7.3.8 What Enhanced Key Usages are required for PKI infrastructure tasks? (OIDs for OSPF and CRL signing, etc)

3
  • 1
    "a certificate that will be time stamped" - What do you mean? A certificate will have two dates: A date before which it is not yet valid and a date after which it is not valid any more. And of course the CA will set a stamp, when this certificate was issued.
    – mentallurg
    Commented May 5, 2023 at 22:33
  • Or are you going to implement a Time Stamp Authority?
    – mentallurg
    Commented May 5, 2023 at 22:43
  • Yes. that is exactly right.
    – user204427
    Commented May 6, 2023 at 0:11

1 Answer 1

1

A search for oid 1.3.6.1.5.5.7.3.3 returns for me as the first hit the entry in the OID reference database which says:

Description by oid_info
Indicates that a certificate can be used for code signing


Does this value mean the certificate will be time stamped as I requested?

No. This is not how timestamping in the context of code signatures work. It is not the code signing certificate which gets timestamped but the code itself is timestamped. And this timestamping of the code is not done with the code signing certificate but by some external timestamp service. And the signature created by this timestamp service gets included into the code signature as a countersignature. See Verifying Windows binaries, without Windows for deeper technical details how this is then stored.

This means that the code signing certificate itself will not have any OID related to timestamping, only OID related to code signing.

3
  • I read that as well, but it does not indicate if the certificate will be time stamped. Not all code signing certs are time stamped.
    – user204427
    Commented May 5, 2023 at 22:18
  • @user204427: I've updated the answer to explain how timestamping in code signing works and why you don't have a OID related to timestamping in your code signing certificate. Commented May 6, 2023 at 6:15
  • Steffen is correct. It is done with a signing tool as explained further by Microsoft: > "Signing tools from Microsoft allow developers to affix time stamps > at the same time as they affix Authenticode signatures. Time stamping > allows Authenticode signatures to be verifiable even after the > certificates used for signature have expired."
    – user204427
    Commented May 6, 2023 at 14:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .