如何验证签名代码的时间戳是否正确完成
我刚刚从 StartSSL 获得代码签名证书，并尝试对我们的安装程序进行签名。
签名过程进展顺利，我得到了一个安装程序 exe，Windows 不再抱怨来自未知发行商。这太棒了！
不过，我试图确保时间戳也能像宣传的那样工作，因此我将我的 PC 日期移至 2012 年（在我的代码签名证书到期日期之后）。
这应该不会有任何区别，但是当我运行相同的安装程序 exe 时，我现在得到同样令人讨厌的“未知发布者”警告。
查看“数字签名”选项卡中 exe 的属性，我绝对可以看到时间戳显示为今天（2010 年），但这似乎根本没有帮助。
谷歌搜索没有给我任何信息，除了如果你在时间戳字段中看到日期，那么一切都OK。我不敢相信这一点，我的电脑抱怨说它不正常。
有谁知道这个时间戳概念是否有效以及如何确保我正确签署可执行文件？
谢谢。
I have just got my code signing certificate from StartSSL and am trying to sign our installer.
The signing process goes well and I get an installer exe that Windows no longer complains about being from unknown publisher. This is great!
However I tried to make sure that the timestamping also works as advertised so I moved my PC date to 2012, after my code signing certificate expiration date.
This supposedly should not make any difference but when I run the same installer exe I now get the same nasty "unknown publisher" warning.
Looking at the properties of the exe in the Digital Signatures tab I can definitely see that the timestamp shows today (2010) but this does not seem to help at all.
Googling gave me nothing except that if you see the date in the Timestamp field then all is OK. I cannot believe this, my PC with advanced date complains that it is not OK.
Does anyone know if this timestamping concept works at all and how to make sure I am signing the executable correctly?
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
StartSSL 颁发的代码签名证书包含增强型密钥使用 (EKU) 属性“生命周期签名”(1.3.6.1.4.1.311.10.3.13)，这会导致文件签名在证书过期时过期，无论任何时间戳如何。
The code-signing certificates issued by StartSSL contain the enhanced key usage (EKU) attribute "Lifetime Signing" (1.3.6.1.4.1.311.10.3.13), which causes the file signatures to expire when the certificate expires, regardless of any timestamps.
抱歉，我没有答案，但根据 Comodo 的即时 SSL 常见问题解答。
Comodo在这个问题上似乎很权威，所以我倾向于相信他们所说的。
我自己也在焦急地等待答案，因为我非常想自己从 StartSSL 购买代码签名证书。我确实在他们的网站上注意到，代码证书是“测试版”，所以也许这是他们需要解决的问题。
Sorry, I don't have an answer for you, but it does look like you shouldn't be seeing the behavior that you are, according to Comodo's Instant SSL FAQ.
Comodo seems to be authoritative on this subject, so I'm inclined to believe what they say.
I'm anxiously waiting for the answer on this myself, because I'd very much like to purchase a code signing cert from StartSSL myself. I did notice on their site, that the code certs are 'beta' so maybe this is something they need to get the kinks worked out of.
“签名时间”和“盖章签名者”的时间戳之间存在差异。签名时间是您实际对代码进行签名的时间，其中时间戳来自“盖章签名者”（证书服务器）。
使用证书颁发者时间戳进行签名实际上可以确保即使您的证书已经过期，您的签名仍然有效。
There is a difference between the "Signing Time" and the Timestamp from the "Stamping Signer". The Signing time is the time when you actually signed the code, when the timestamp is from the "stamping signer" (the certificate server).
Signing with the certificate issuer timestamp will actually make sure that your signature is still valid even if your certificate already expired.