Test for a Valid Certificate?

nsnb
22nd October 2009 21:21 UTC

Test for a Valid Certificate?
Is there a way (or plugin) to test a digitally signed installer (with a code signing certificate), from within that installer, that the digital signature exists and valid?

That is, the the file has not been tampered with after it was signed?

I know how to do it visually, by looking at the corresponding Properties tab. Is it possible to do this programmatically from within the installer?

Thanks.

MSG
23rd October 2009 07:08 UTC

Wouldn't this be a chicken-egg problem? You can't enter the checksum in the installer without changing the installer's checksum...

Though I do seem to recall some signing solutions existing. Maybe someone else knows.

nsnb
26th October 2009 05:56 UTC

Originally posted by MSG
Wouldn't this be a chicken-egg problem? You can't enter the checksum in the installer without changing the installer's checksum...

Not really a chicken-and-egg because I don't expect to read the installer's checksum for that: The digital certificate is appended and itself includes a stronger hashing of the entire file.

The nice thing about those digital certificates is that if anyone modifies anything inside the file (e.g. infecting with a virus), one could see immediately from the tab that it is no longer signed by so called "verified publisher".

So, all we really need is a way to look at this "tab" and tell go/no-go.

Any idea how to do that?

820815
26th October 2009 09:53 UTC

Originally posted by MSG
You can't enter the checksum in the installer without changing the installer's checksum...

There's not a problem to fix its last four bytes.

Anders
26th October 2009 10:37 UTC

There is really no point to do this, NSIS already checks itself with a CRC (And "pirates" will get around it anyways, or just extract the files without running the installer)

If you really want to do this, call Wintrust::CryptCATAdminCalcHashFromFileHandle (and WTHelperGetProvSignerFromChain or CryptCATAdminEnumCatalogFromHash?) and WinVerifyTrust with the system plugin

See also:
http://forum.sysinternals.com/forum_posts.asp?TID=19404
http://forum.sysinternals.com/forum_...6893&PID=83634
http://forum.sysinternals.com/forum_posts.asp?TID=19247