What happens if a certificate used to sign the driver and the DLL expires?
There are several key points to discuss on this topic:
- Different certificates are used to sign different modules. DLLs are signed by Callback Technologies using the company's certificate, which is issued by a certificate authority (CA). On the other hand, drivers are signed by Microsoft with their own certificates. As a result, these certificates have different lifetimes and are managed by different CAs.
- The signature of the DLLs is not automatically checked, although your application’s installer might do this if necessary. During installation of the drivers, the signature of the CAB file containing the drivers is verified by the component using Windows API functions. Then, when the system starts, Windows checks the signature of the loaded drivers.
- All signed files are also timestamped. According to the certificate validation rules established in the PKI standards, the signature will remain valid unless a CA revokes the signing certificate, at least until the timestamping (TSP) certificate expires. Generally, TSP certificates are designed to have a long lifetime to prevent validation from failing for a considerable amount of time. What happens when the TSP certificate expires is determined by the OS that will validate the timestamp in the future (many years down the line).
We appreciate your feedback. If you have any questions, comments, or suggestions about this article please contact our support team at support@callback.com.