“Certificate in signature cannot be verified” for Thawte certificate

Question

I need to sign the Application.exe file with the certificate that is stored in company.pfx. So, I used signtool:

signtool.exe sign /p password /f company.pfx /t http://timestamp.verisign.com/scripts/timestamp.dll /v Application.exe The following certificate was selected: Issued to: Company, Inc. Issued by: Thawte Code Signing CA - G2 Expires: Wed Aug 27 02:59:59 2014 SHA1 hash: A2A0BD7C4516BF8C88AECC3A568CE9BB5D63902D Done Adding Additional Store Successfully signed and timestamped: App1_old.exe Number of files successfully Signed: 1 Number of warnings: 0 Number of errors: 0 

signtool said no errors. But in the description of the digital signature, the message "The certificate in the signature cannot be verified" appears. and there is no certification path.

In Details, there is the “Extended error information” property, which states that “Revocation status: revocation function could not verify the revocation because the revocation server was disconnected.”

Image of Application.exe

To investigate the problem, I used sigcheck (-a key) in the application and it says: "Checked: certificate chain cannot be built with a trusted root center."

Then I imported the pfx file into the repository, and the certificate seems to be in order.

Certificate Image

I searched stackoverflow about my topic and found some links, and that helps.

How to create PFX with my certificate chain?

How can I sign an ActiveX control with a code signing certificate and be verified by the publisher?

The solution is to extract the certificate from pfx (using OpenSSL) and apply it using the / ac argument

 openssl pkcs12 -in company.pfx -out company_cl.pem -nodes -clcerts openssl x509 -in company_cl.pem -out company_cl.cer -outform DER signtool sign /ac company_cl.cer /p password /f company.pfx /t http://timestamp.verisign.com/scripts/timstamp.dll /v Application.exe The following certificate was selected: Issued to: Company, Inc. Issued by: Thawte Code Signing CA - G2 Expires: Wed Aug 27 02:59:59 2014 SHA1 hash: A2A0BD7C4516BF8C88AECC3A568CE9BB5D63902D Cross certificate chain (using machine store): Issued to: thawte Primary Root CA Issued by: thawte Primary Root CA Expires: Thu Jul 17 02:59:59 2036 SHA1 hash: 91C6D6EE3E8AC86384E548C299295C756C817B81 Issued to: Thawte Code Signing CA - G2 Issued by: thawte Primary Root CA Expires: Sat Feb 08 02:59:59 2020 SHA1 hash: 808D62642B7D1C4A9A83FD667F7A2A9D243FB1C7 Issued to: Company, Inc. Issued by: Thawte Code Signing CA - G2 Expires: Wed Aug 27 02:59:59 2014 SHA1 hash: A2A0BD7C4516BF8C88AECC3A568CE9BB5D63902D Done Adding Additional Store Successfully signed and timestamped: Application.exe Number of files successfully Signed: 1 Number of warnings: 0 Number of errors: 0 

Now the message in Digital Security Details is Digital Signature OK.

But I can’t understand why I need to use the / ac argument. Does anyone have any ideas?

---

Ed.

I checked the first version of the application (without / ac) with Application.exe, and it gives me additional information:

 signtool.exe verify /v /kp Application.exe Verifying: Application.exe Hash of file (sha1): 5CBB228F4F206C65AAC829ACF40C297F291FE0A7 Signing Certificate Chain: Issued to: Company, Inc. Issued by: Thawte Code Signing CA - G2 Expires: Wed Aug 27 02:59:59 2014 SHA1 hash: A2A0BD7C4516BF8C88AECC3A568CE9BB5D63902D The signature is timestamped: Fri Mar 29 18:42:56 2013 Timestamp Verified by: Issued to: Thawte Timestamping CA Issued by: Thawte Timestamping CA Expires: Fri Jan 01 02:59:59 2021 SHA1 hash: BE36A4562FB2EE05DBB3D32323ADF445084ED656 Issued to: Symantec Time Stamping Services CA - G2 Issued by: Thawte Timestamping CA Expires: Thu Dec 31 02:59:59 2020 SHA1 hash: 6C07453FFDDA08B83707C09B82FB3D15F35336B1 Issued to: Symantec Time Stamping Services Signer - G4 Issued by: Symantec Time Stamping Services CA - G2 Expires: Wed Dec 30 02:59:59 2020 SHA1 hash: 65439929B67973EB192D6FF243E6767ADF0834E4 SignTool Error: WinVerifyTrust returned error: 0x800B010A A certificate chain could not be built to a trusted root authority. Number of files successfully Verified: 0 Number of warnings: 0 Number of errors: 1 

"The certificate chain cannot be created for the trusted root center." But why?

Answer 1

I found an article on signing files using a Thawte certificate: http://codingexpedition.wordpress.com/2011/04/21/thawte-code-signing-pfx/

It seems that the / ac signtool option is always required. So, I extracted the Thawte certificates to the .cer file and applied it with the / ac switch.

 openssl pkcs12 -in company.pfx -out company_ca.pem -nokeys -cacerts openssl x509 -in company_ca.pem -out company_ca.cer -outform DER signtool sign /ac company_ca.cer /p password /f company.pfx /t timeserver /v Application.exe 

And it works great!

Answer 2

It seems like using the old version from

 C:\Program Files\Microsoft SDKs\Windows\v6.0\Bin\signtool.exe 

also solves the problem.

Answer 3

This problem may be due to the lack of an intermediate certificate. Compare the certificate on both machines (double-click on the same computer) and view the Certificate Path tab. If any intermediate node certificate is missing, then export the same certificate from the old machine and import it to the new computer.