0

I recently purchased a new EV certificate (having previously used an OV certificate) and have successfully used it to sign my files.

However I'm getting a lot of warnings from Microsoft Defender about low trust levels on the file and the users of my software are unable to install it without jumping through hoops.

The Publisher that Defender shows looks suspect to me:

enter image description here

That's:

Publisher: GB, Private Organization, 07922175, GB, Nuneaton, elsten software limited, elsten software limited

The name of my company is elsten software limited so shouldn't it just show that? I'm worried we've lost reputation because the above is not matching our company name.

In the public key, the Subject field is formatted as so:

Subject: jurisdictionC = GB, businessCategory = Private Organization, serialNumber = 07922175, C = GB, L = Nuneaton, O = elsten software limited, CN = elsten software limited

The jurisdictionC bit looks suspicious - could the lack of whitespace, or the presence of jurisdiction mean the Subject isn't being parsed correctly?

When the app is run, the certificate warning screen shows the publisher correctly:

enter image description here

Also, if I show the Certificate details on the file from Windows Explorer it looks correct:

enter image description here

So is the certificate correct, but I just need to build some reputation? Or could Defender be parsing the certificate's Subject line differently and failing to match the reputation as a result?

For the purposes of code signing, do we only need to get a new public key certificate if this is wrong?

7
  • 1
    The formatting of the subject line has nothing to do with the reputation of the certificate. A certificate only assures that the author of the signed software is the one claimed. It does not say anything about the trustworthiness of the author, their ability to write secure software etc - so nothing about the reputation. Commented Apr 29 at 10:18
  • 1
    The certificate looks fine, and it seems like Defender is parsing the fields correctly. Although signing your file with an EV cert will increase the file's trust score with Defender, this alone may not be enough to get the score to the level where warnings are no longer displayed. See stackoverflow.com/questions/77101110/… for more info.
    – mti2935
    Commented Apr 29 at 11:35
  • 1
    Thank you both - you're welcome to add "The Subject line is formatted correctly" as an answer I can tick. Commented Apr 29 at 12:44
  • Those fields are required (by CABforum) in an EV codesigning cert so you can't get a cert without them that anyone including Microsoft will ever trust Commented Apr 30 at 1:29
  • 1
    This is a different attribute than the standard X.500 Country aka C, which is also present separately in your Subject. The official names of OIDs don't allow spaces and use camelCase, and jurisdictionC is the official LDAP name for what is actually jurisdictionCountryName. Similarly for ASN.1 names businessCategory and serialNumber as you also see. This is partially obscured by the all-cap abbreviations for some attributes, like in your case O=organization CN=commonName as well as C=country. Commented Apr 30 at 23:56

0

You must log in to answer this question.

Browse other questions tagged .