What is the most practical way of finding out which certificate is the problematic one?

Question

I've been using wsusoffline for quite sometime, but recently, I've had this problem. The program downloads an update but then immediately deletes it producing the following warning in the log:

Warning: Deleted unsigned file "H:\Windows\WindowsUpdate\wsusoffline-10\client\w100-x64\glb\windows10.0-kb3172729-v2-x64_ccc19baa66b28b18518e015e10674bd992e258b8.cab"

Here is the file being downloaded.

Internet research reveals this thread which lets us know that this warning is given when sigcheck cannot verify signature of the downloaded file.

In the case of the thread started, the problem was some missing certificate on his machine. I'm getting a different message than him though.

When I run sigcheck like this:

sigcheck.exe windows10.0-kb3172729-v2-x64_ccc19baa66b28b18518e015e10674bd992e258b8.cab

This is the result I'm getting:

Verified: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

My question is how do I locate and view the problematic certificate, so I could investiage this issue further?

Answer 1

In this case the problem certificate is the certificate in the file:

PS C:\_test> $signature = Get-AuthenticodeSignature .\windows10.0-kb3172729-v2-x64_ccc19baa66b28b18518e015e10674bd992e258b8.cab
PS C:\_test> $signature.SignerCertificate

Thumbprint                                Subject
----------                                -------
2383BED52ABD42366137BFA95716AB432BAD6B3E  CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US


PS C:\_test> $signature.SignerCertificate.NotAfter

Wednesday, April 19, 2017 6:07:31 AM

Now you can examine properties of $signature.SignerCertificate at your leisure or even export the certificate to a file as per usual, for further processing/storage.