TL;DR : If you digitally sign your software you need to make sure you have an SHA2 certificate and use it to dual sign your software with both SHA1 and SHA2 digests.
Digital certificates are used to prove who authored a piece of software and that it hasn’t subsequently been tampered with. Starting with Windows XP SP2 you get a warning message if you download software that that isn’t signed with an appropriate digital certificate. So most commercial software vendors digitally sign their software. We grumble about price gouging by the certificate vendors and the hoops we have to jump through to get a certificate. But, apart from that, the system seems to work tolerably well. However Microsoft have thrown a spanner into the works by deprecating digital certificates using the SHA1 algorithm. I only found out about this a few weeks ago from a fellow vendor’s blog. Thanks for nothing Microsoft. If you are using a digital certificate you purchased more than a year ago, it is probably SHA1. This post explains what this means for software vendors, based on my research so far. I am not an expert on this topic and things seem to be changing fast, so please let me know if there are any mistakes or omissions.
I don’t digitally sign Windows software, does this affect me?
No. But perhaps treat Windows unsigned software warning with some skepticism until Windows software vendors sort this mess out. If you only develop for Mac OS X you can feel a bit smug (at least until the next time Apple nukes your development ecosystem from orbit).
What is SHA1?
SHA1 (Secure Hash Algorithm 1) is a cryptographic hash function that was used in digital certificates issued until recently. SHA1 was known to have weaknesses as far back as 2005. Microsoft (and Google) have finally decided that SHA1 is too vulnerable and SHA2 digital certificates should be used instead.
What happens if my certificate is SHA1?
If you signed your software with a timestamp before 01-Jan-2016:
- It will be treated by Windows XP SP2/XP SP3/Vista as signed.
- It will be treated by Windows 7/8/10 as signed only until 01-Jan-2017.
If you signed your software with a timestamp on or after 01-Jan-2016:
- It will be treated by Windows XP SP2/XP SP3/Vista as signed.
- On Windows 7/8/10 and you will get an ugly “The signature of <file> is corrupt or invalid” or “The signature of this program is corrupt or invalid” error when downloading. If you don’t see this, it might be because you haven’t done a Windows Update recently (shame on you).
Windows seems to treat software that has been downloaded from the web (with ‘mark of the web’) differently. So make sure you test a version of your software you have downloaded from the web. I carried out some tests on 01-Mar-2016 using an SHA1 certificate to sign an executable and then dowload it. It worked ok when downloaded using Firefox or Chrome, but was shown as corrupt when downloaded using IE.
How do I know if my current certificate is SHA1?
- Right click on your most recently signed installer and select Properties.
- Click on the Digital Signatures tab.
- Select the signature and click on the Details button.
- Click the View Certificate button.
- Click the Details tab.
- Look at the Signature hash algorithm.
What should I do if my certificate is SHA1?
If you certificate hasn’t expired you should ask the company you purchased it from to issue you a new SHA2 certificate. They should do this free of charge. In the process they will revoke your SHA1 certificate, so you can no longer use it for signing. You should then use your new SHA2 certificate to double sign new releases (see below).
I have an SHA2 certificate, now what?
If you want a new release to be treated as signed on both Windows XP SP3/Vista and Windows 7/8/10 then you need to double sign the file for SHA1 and SHA2:
signtool.exe sign /f <pfx file> /p <pfx password> /t <sha1 timestamp server> /v <installer>
signtool.exe sign /f <pfx file> /p <pfx password> /tr <sha2 timestamp server> /fd sha256 /td sha256 /as /v <installer>
Note the the order of the above is important (SHA1 first).
The Comodo SHA1 and SHA2 timestamp server is:
http://timestamp.comodoca.com
You can add a /debug flag for verbose output.
If you only want to support Windows 7/8/10, then you can omit the first line (but why would you?).
You can use chktrust.exe to check the signature:
chktrust.exe <installer>
Note that only version 6.3 and later of signtool.exe (which comes with Windows 8.1 SDK and is also available here) supports the /as flag.
I always sign the program, as well as the installer.
Can I double sign .msi files?
I have seen reports that .msi installers don’t support double signing. But I don’t use .msi installers, so I haven’t investigated further.
What happens to software I signed with my SHA1 certificate after the certificate is revoked?
Software you signed previously will not be affected, e.g. it will be treated as signed by Windows 7/8/10 until 01-Jan-2017
How do I sign Windows XP SP1/XP SP2 software?
Windows XP SP1 doesn’t warn you if there is no signature, so you can ignore XP SP1. SHA2 signatures are not supported in Windows XP SP2. So you will need to have both valid SHA1 and SHA2 certificates to support XP SP2 and all the later versions of Windows. Its not clear that certificate vendors will allow this. Also, how many people with Windows XP SP2 (an unsupported OS) are out there buying software? I won’t be bothering to support signing for XP SP2.
Does this affect SSL certificates as well as code signing (Authenticode) certificates?
I believe so. But I don’t have any SSL certificates, so I haven’t investigated further.
How does this affect signing of device drivers?
I understand there are some differences for device drivers. But I don’t create device drivers, so I haven’t investigated further.
What is the difference between SHA2 and SHA256?
SHA2 is a family of two similar hash functions known as SHA256 and SHA512. SHA256 uses 32-bit words where SHA512 uses 64-bit words.
How secure is SHA2?
Er, it was designed by the NSA. Supply your own joke.
I don’t have a digital certificate, where can I get one?
I got my Comodo code signing certificate from reseller ksoftware.net. They have a good reputation, and are significantly cheaper than Comodo. I don’t have any business relationship with them beyond being a happy customer.
Update: See renewing my authenticode digital certificate .
Anything else I should know?
Microsoft has reserved the right to move the SHA1 deprecation date forward from 01-Jan-2017.
Acknowledgements
Thanks to Nikos Bozinis for first alerting me to this issue and to Mitchell Vincent of ksoftware.net for fact checking this article.
Further reading
http://zabkat.com/blog/code-signing-sha1-armageddon.htm
Updates
02-Mar-2016: Added missing link and minor update.
03-Mar-2016: Minor update.
25-Feb-2023: Added link to https://successfulsoftware.net/2023/02/25/renewing-my-authenticode-digital-certificate/.
Successful Software 