为什么我的代码签名(MS Authenticode)验证失败?

11
我发布了这个问题,并获得了Thawte颁发的全新代码签名证书。
我按照指示操作(至少我认为是这样),代码签名似乎成功了,但是当我尝试验证时,工具显示错误。
验证步骤的结果似乎表明它是正确的,但是出现了一个错误,而且没有任何解释为什么会出现错误。
非常感谢任何评论或建议。
签署exe的命令行:
signtool sign /f mdt.pfx /p password /t http://timestamp.verisign.com/scripts/timstamp.dll test.exe

结果:

The following certificate was selected:
    Issued to: [my company]

    Issued by: Thawte Code Signing CA

    Expires:   4/23/2011 7:59:59 PM

    SHA1 hash: 7D1A42364765F8969E83BC00AB77F901118F3601


Done Adding Additional Store


Attempting to sign: test.exe

Successfully signed and timestamped: test.exe


Number of files successfully Signed: 1

Number of warnings: 0

Number of errors: 0

请注意,没有错误或警告。

现在,当我尝试验证时,想象一下我的惊讶:

signtool verify /v test.exe

结果为:

Verifying: test.exe

SHA1 hash of file: 490BA0656517D3A322D19F432F1C6D40695CAD22
Signing Certificate Chain:
    Issued to: Thawte Premium Server CA

    Issued by: Thawte Premium Server CA

    Expires:   12/31/2020 7:59:59 PM

    SHA1 hash: 627F8D7827656399D27D7F9044C9FEB3F33EFA9A


        Issued to: Thawte Code Signing CA

        Issued by: Thawte Premium Server CA

        Expires:   8/5/2013 7:59:59 PM

        SHA1 hash: A706BA1ECAB6A2AB18699FC0D7DD8C7DE36F290F


            Issued to: [my company]

            Issued by: Thawte Code Signing CA

            Expires:   4/23/2011 7:59:59 PM

            SHA1 hash: 7D1A42364765F8969E83BC00AB77F901118F3601


The signature is timestamped: 4/27/2010 10:19:19 AM

Timestamp Verified by:
    Issued to: Thawte Timestamping CA

    Issued by: Thawte Timestamping CA

    Expires:   12/31/2020 7:59:59 PM

    SHA1 hash: BE36A4562FB2EE05DBB3D32323ADF445084ED656


        Issued to: VeriSign Time Stamping Services CA

        Issued by: Thawte Timestamping CA

        Expires:   12/3/2013 7:59:59 PM

        SHA1 hash: F46AC0C6EFBB8C6A14F55F09E2D37DF4C0DE012D


            Issued to: VeriSign Time Stamping Services Signer - G2

            Issued by: VeriSign Time Stamping Services CA

            Expires:   6/14/2012 7:59:59 PM

            SHA1 hash: ADA8AAA643FF7DC38DD40FA4C97AD559FF4846DE



Number of files successfully Verified: 0

Number of warnings: 0

Number of errors: 1
1个回答

16

尝试使用 Signtool verify /v /pa foo.exe

参考自使用 Signtool 验证文件签名(重点是我的)

Signtool verify MyControl.exe

如果上面的示例失败了,可能是因为签名使用了代码签名证书。Signtool 默认采用 Windows 驱动程序策略进行验证。

以下命令使用默认身份验证验证策略验证签名:

Signtool verify /pa MyControl.exe


谢谢。/pa 让它起作用,但当我发布我的代码时,这是否会被接受? - Tim
@Tim,没问题的。我认为“驱动程序策略”需要特殊证书。只需从Windows资源管理器中查看.exe文件属性,您应该会看到显示的“数字签名”。 - Roddy

网页内容由stack overflow 提供, 点击上面的
可以查看英文原文,
原文链接