Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When downloading executables from the Internet, I always check to see if they are digitally signed before I feel safe running them.

In Windows, when right-clicking a digitally-signed file and selecting Properties, a digital signature tab will be present in the Properties dialog.

What I'd like to know is: does Windows actually verify the digital signature when it is shown in the Properties dialog, or does it merely indicate that the file contains a digital signature that may or may not be valid?

share|improve this question
add comment

1 Answer

Windows comes with a certificate store that contains certificates from all the Trusted Root Certification Authorities (CAs). Windows can tell if one of these Authorities issued the certificate used to sign the executable by checking the signature against the certificates in the store.

So basically, the answer is yes, Window does ineed verify the digital signature. Note that it's up to the CA to make that the entity they sold the certificate to is who they claim to be. So when you trust the report that the executable comes from XYZZY software, you're doing so on the say-so of the CA.

share|improve this answer
1  
Also be sure to hit Windows update for any CRL (Certificate Revocation List) updates in case one or more CAs have had their certificates compromised and needed to recall them. –  Mark Allen Oct 28 '12 at 5:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.