Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 2 down vote favorite

I have a signed executable. The certificate for that signature says it is usable until 2007, still Windows (7 Professional) says it is valid if I'm opening it via properties dialog.
How is that possible?

share|improve this question
2  
Just guessing, but ... because the certificate was still valid at time of signing? – grawity Oct 18 '11 at 19:41
but shouldn't it be invalid if it expired? I mean, I can not verify the signature because I can not trust that cert. anymore ... – ragnq Oct 18 '11 at 19:47
The signature itself is valid. It has no expiration date, only date of signing. – grawity Oct 18 '11 at 20:44
@ragnq: Think of the signatures on the Declaration of Independence. All the signers are dead, but the signatures are valid. . . – surfasb Oct 19 '11 at 2:26
@surfasb That state is not following it though. But thats another story ... My question is about the certificate which is supposed to be invalid, but is not in Windows opinion. – ragnq Oct 19 '11 at 16:03

1 Answer

up vote 3 down vote accepted

The whole point of a signature is that it is permanent, irrevocable, and undeniable. Provided you can prove that a signature was made during the validity interval for a certificate, you should accept that signature as valid.

You are correct that you cannot trust that certificate anymore to make new signatures because it could have been compromised, unless it was revoked, you should assume that it was trusted during its validity interval. In this case, you can prove the signature was made during that validity interval (because the signature is timestamped by an authority you still trust and the signing certificate was never revoked). So the signature is forever valid.

Whether a certificate is shown as 'valid' or not depends on whether it is valid in the context in which you are viewing it.

share|improve this answer
But my question is not about the signature, it's about the certificate which is valid in Windows opinion, even if it is expired. – ragnq Oct 19 '11 at 15:59
The certificate is still valid for checking signatures made during its validity interval, since it has not been revoked. – David Schwartz Oct 19 '11 at 17:08
So Windows knows that it's used just for that thing? If you open the properties window -> Digital Signatures -> Details (="Valid") -> Show Cert. -> Cert.Path -> Last Cert = "Valid" – ragnq Oct 19 '11 at 17:33
Wow, you're right, I managed to open it with another way and there it's marked invalid. Didn't know these certificate views could differ. Thanks (Can you add the sentence to your answer, that certs are shown, and as we can see here also validated, differently based on the context) – ragnq Oct 19 '11 at 17:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.