1

How do I use OpenSSL to show the certificate and signature information attached to a binary (e.g. windows exe or msi)?

I know that it's possible to read certificates directly from certificate files like openssl x509 -in cert.crt -text and that it's also possible to verify files (what is not what i want because i do not have a certificate to do so), but how to check if a file has a digital signature and get additional info if so.

I also checked Stackoverflow and Google for more info, but all searches brought me to pages on how to "verify binarys" and not "get them"

Improve this question
2
  • Did you check those pages anyway? I'd expect the "getting" part to be part of the process. So after "getting" the signature you should be able to examine it closer. That would be my thinking. In addition consider using the apostrophe to mark lines like the openssl one differently.
    – Seth
    Nov 17, 2016 at 8:49
  • I think the term of interest is Authenticode. That's Microsoft PFX signing applied to PE and PE+ files. With that said, here's a good tutorial on signing from Mozilla: Signing an executable with Authenticode. Finding the verification commands is left as an exercise for the reader :)
    – jww
    Nov 17, 2016 at 20:48

1 Answer 1

Reset to default
1

After doing a lot of research, it seems that openssl simply is not able to "get" a certificate / Authenticode the easy way just by offering the binary. In the end, I found a python module thats capable of extracting authenticode certificates -> pefile. So I decided to use that since I need a automatable soloution anyway. Also Windows Signtool should be capable of doing so which seems also to be aviable for Mono (when working on non windows platforms).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .