Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When downloading executables from the Internet, I always check to see if they are digitally signed before I feel safe running them.

In Windows, when right-clicking a digitally-signed file and selecting Properties, a digital signature tab will be present in the Properties dialog.

What I'd like to know is: does Windows actually verify the digital signature when it is shown in the Properties dialog, or does it merely indicate that the file contains a digital signature that may or may not be valid?

share|improve this question

On Windows 8.1 the properties display for the file only displays a list of digital signatures. You have to highlight a signature and click Details before Windows will tell you if the signature is valid or not.

I went to the expense and bother of getting a code signing certificate. The first thing I did was sign an executable and then modify the executable to simulate tampering. If you select properties for the tampered file all you see is a digital signature with no warning if it is valid or not.

Windows also allowed me to execute the application even though it has been tampered.

share|improve this answer
This is not an answer to the original question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. – DavidPostill Jan 29 '15 at 6:36

Windows comes with a certificate store that contains certificates from all the Trusted Root Certification Authorities (CAs). Windows can tell if one of these Authorities issued the certificate used to sign the executable by checking the signature against the certificates in the store.

So basically, the answer is yes, Window does ineed verify the digital signature. Note that it's up to the CA to make that the entity they sold the certificate to is who they claim to be. So when you trust the report that the executable comes from XYZZY software, you're doing so on the say-so of the CA.

share|improve this answer
Also be sure to hit Windows update for any CRL (Certificate Revocation List) updates in case one or more CAs have had their certificates compromised and needed to recall them. – Mark Allen Oct 28 '12 at 5:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .