Adobe code signing certificate revocation and SCCM

We have many install packages for different Adobe products in SCCM 2007 but nothing that would have been obtained or downloaded from Adobe since July 10, 2012. Does that mean we don’t have to do anything? Is that a correct interpretation of your statements about the Adobe code signing certificate revocation issue?

Yes. That's correct.

Similar Messages

Adobe's Signing Certificates?

Where is Adobe's signing certificate? And are there hashes for downloads posted somewhere? I found a PGP public key tucked away in the dark corners of the security section of their company page, but can't find certificates anywhere. That seems wrong for a company with such a huge online presence.

All of them. I'm talking about the certificate used to verify the security of the connection to Adobe's websites. It's probably more for tin foil hat types like me, but since it's sort of become a standard protocol and since it's not hard to spoof websites, I like to check those things out and make sure they're set up in my browser and email apps.
The hashes are less of a concern since most of the downloads come through Creative Cloud, but a lot of places have a general repository showing the files and their hash. For example, Ubuntu lists theirs here: UbuntuHashes - Community Help Wiki.

Adobe AIR 3 Performance Issues and Code Signing Certificate Problem

I recently updated to Adobe AIR 3.0 SDK (and runtime) doing HTML/Javascript development using Dreamweaver CS5.5 in a Windows 7 Home Premium (64 bit).
The AIR app I'm developing runs well from within Dreamweaver. But when I create/package the AIR app and install it on my machine:
1. The app literally CRAWLS running it in my Windows 7 12G RAM machine (especially when I use the mouse to mouse over a 19-by-21 set of hyperlinks on a grid) --- IT IS THAT SLOOOOWWWW...
2. The app runs fine in my Mac OS X 10.6.8 with 4G RAM, also using the Adobe AIR 3 runtime.
About the Code Signing Certificate problem:
When I try to package the AIR app with ADT using AIR's temporary certificate feature, I get the error message "Could not generate timestamp: handshake alert: unrecognized_name".
I found some discussions on this problem in an Adobe AIR Google Groups forum, but no one has yet offered any resolution to the issue. Someone said Adobe is using the Geotrust timestamping service --- located at https://timestamp.geotrust.com/tsa --- but going to this page produces a "404 --- Page not found" error.
The Google Groups Adobe AIR page is here:
http://groups.google.com/group/air-tight/browse_thread/thread/17cd38d71a385587
Any ideas about these issues?
Thanks!
Oscar

I recently updated to Adobe AIR 3.0 SDK (and runtime) doing HTML/Javascript development using Dreamweaver CS5.5 in a Windows 7 Home Premium (64 bit).
The AIR app I'm developing runs well from within Dreamweaver. But when I create/package the AIR app and install it on my machine:
1. The app literally CRAWLS running it in my Windows 7 12G RAM machine (especially when I use the mouse to mouse over a 19-by-21 set of hyperlinks on a grid) --- IT IS THAT SLOOOOWWWW...
2. The app runs fine in my Mac OS X 10.6.8 with 4G RAM, also using the Adobe AIR 3 runtime.
About the Code Signing Certificate problem:
When I try to package the AIR app with ADT using AIR's temporary certificate feature, I get the error message "Could not generate timestamp: handshake alert: unrecognized_name".
I found some discussions on this problem in an Adobe AIR Google Groups forum, but no one has yet offered any resolution to the issue. Someone said Adobe is using the Geotrust timestamping service --- located at https://timestamp.geotrust.com/tsa --- but going to this page produces a "404 --- Page not found" error.
The Google Groups Adobe AIR page is here:
http://groups.google.com/group/air-tight/browse_thread/thread/17cd38d71a385587
Any ideas about these issues?
Thanks!
Oscar

What code signing certificate has to be added for Adobe Air Native Installer?

Hi,
I'm developing Adobe Air application. I need to digitally verify the application to add the publisher's name with the product. I did a little research and came to know that Symantec, Thawte, Comodo, Comodo-Tucows, Digicert, Godaddy and couple of others are doing this.
Yes. I'm talking about the Code Signing Certificate. My question is, What code signing certificate has to be added for Adobe Air Native Installer? The reason is, The native installer will have an extension .exe ( Windows ) and .dmg ( MAC OS X ).
These guys are providing certificate for Adobe Air. For instance, If the application is exported using Native Installer in Windows, The application will have an .exe extension. For this, Can I use the same Adobe Air code signing certificate or Should I go for Microsoft Autheticode ( for .exe ) certificate?
Thanks in advance.

I think comodo code signing certificate is one of the nice option to be added for Adobe Air, as i have seen comodo code signing certificate in other adobe programs. Recently i bought comodo code signing from https://cheapsslsecurity.com/comodo/codesigningcertificate.html, to sign one of my adobe application and it works fine, you can use microsoft authenticode technology with comodo code signing.

Differences between SSL and Code-Signing Certificates

Hello,
I unsuccessfully tried to use a SSL - certificate for signing an applet (converting from X.509 to PKCS12 prior to signing) and learned, that SSL certificates and code-signing certificates are different things (after seeking the web for ours). Can somebody point out some source of information about this topic ? What are these differences ? Can I convert my SSL certificate into a code-signing certificate ?
Things got even more confusing for me, since my first attempt with an wrongly converted SSL cetificate (I used my public and private key for conversion only, omitting the complete chain) at least worked partly: the certificate was accepted, but marked as coming from some untrustworthy organisation. After making a correct conversion (with the complete chain) the java plugin rejected the certificate completely ...
Ulf

yep, looks like it.
keytool can be used with v3 x509 stores:
Using keytool, it is possible to display, import, and export X.509 v1, v2, and v3 certificates stored as files, and to generate new self-signed v1 certificates. For examples, see the "EXAMPLES" section of the keytool documentation ( for Solaris ) ( for Windows ).
jarsigner needs a keystore so I would assume public and private key pair.
you could list the keys from your store:
C:\temp>keytool -list -keystore serverkeys.key
Enter keystore password: storepass
Keystore type: jks
Keystore provider: SUN
Your keystore contains 2 entries
client, Jul 5, 2005, trustedCertEntry,
Certificate fingerprint (MD5): 13:50:77:64:94:36:2E:18:00:4B:90:65:D0:26:22:C8
server, Jul 5, 2005, keyEntry,
Certificate fingerprint (MD5): 20:90:49:6F:46:BA:AB:11:75:39:9F:6F:29:1F:AB:58
The server is the private key, this can be used with jarsigner (alias option).
C:\temp>jarsigner -keystore serverkeys.key -storepass storepass -keypass keypass
-signedjar sTest.jar test.jar client
jarsigner: Certificate chain not found for: client. client must reference a val
id KeyStore key entry containing a private key and corresponding public key cert
ificate chain.
C:\temp>jarsigner -keystore serverkeys.key -storepass storepass -keypass keypass
-signedjar sTest.jar test.jar server

Applocker and expired code signing certificates

Is it possible to allow applocker to use expired code signing certificates for old applications ?
Thanks, Magnus
Magnus

Hi Magnus,
>>Is it possible to allow applocker to use expired code signing certificates for old applications ?
As far as I know, we should be unable to do this. If a certificate is expired, it is no longer considered an acceptable or usable credential.
Regarding this question, the following thread can be referred to as reference.
AppLocker Issue in Windows 7
https://social.technet.microsoft.com/Forums/windows/en-US/2c78848d-2601-40d2-99c0-9b5c23b735e4/applocker-issue-in-windows-7?forum=w7itprosecurity
Best regards,
Frank Shen
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Managing Windows Phone's and Symantec Code Signing certificate

Hi,
We need to renew the code signing certificate from Symantec. However, we only use it to manage the Windows Phone devices and don't publish apps. Do we still need to spend $300 on renewing this cert? Can't I manage them for free like our iOS and Android devices?

You REQUIRE the Symantec Code Signing Certificate to manage Windows Phones via Windows Intune. This is a requirement of the device rather than the management solution.
You CAN manage Windows Phones without this cert using only Exchange active sync management in Intune. However this management is very basic and has no advanced features (basically the features provided by Exchange rather than Intune).
Gerry Hampson | Blog:
www.gerryhampsoncm.blogspot.ie | LinkedIn:
Gerry Hampson | Twitter:
@gerryhampson

Code Signing Certificate Options

Hi Guys,
Have just finished and Air application and need to sign it before distribution. Anyone got any good advice on the pros and cons of the various Code Signing options for Adobe Air out there?
Richard

I have just created a self-signed code-signing certificate, I used XCA to generate it which is a front-end for openssl. Obviously being generated from a self-signed rootCA it is not going to be trusted by the outside world but it is good enough for an internal Profile Manager setup since the enrollment process will automatically trust your own self-signed rootCA.
Anyway, when trying to install it I did come across a gotcha which might help you and others here. I found that if I imported the certificate in to Keychain Access e.g. by double-clicking on it, then Server.app did not list it as an available certificate for Profile Manager code-signing. However if instead I used the option in Server.app under Profile Manager to import the code-signing certificate it was accepted.
In theory importing via Keychain Access should work as well but it did not, so if you have been doing it that way try importing via Server.app instead.
If you have already imported it via Keychain Access just delete it from your Keychain and try again.
With regards to the suggestion from ajm_from_WA for buying one from www.ssls.com I could not find any code-signing certificates listed on their website. These are different to ordinary website certificates.

Code-signing Certificate Renew issue

We recently renewed our Verisign code-signing certificate, only to discover that it breaks the auto-update process with the notorious error "This application cannot be installed because this installer has been mis-configured." We were able to make it work by using the ADT -migrate command. That is all well and wonderful. But there are two issues I see. First, there is a 180 day cut-off, beyond which users can no longer be updated. Then, when our certificate gets renewed again next year we might be stuck in a situation where we have to choose which users get to be updated and which are orphaned and are forced to uninstall/re-install.
Furthermore, how much of this pain we have to live with becomes a function of how long a certificate we are willing to pay for. If we're a small company forking out the money for a 3 year certificate might be kind of painful. Why should this be a factor? Why is it not straight-forward to renew the same certificate and have installations back to the beginning of time be alright with it?
It could be there is something about the renewal process that is not right. However, when I renewed my Verisign cert their process pretty much forced me to keep everything about the renewed cert the same as the original, otherwise it would not be a 'renewal'.
If there is an arcane trick we are missing I would be most appreciate to know what it is. This should not be this difficult.
Thanks
Kevin

Hi Kevin,
I've asked around and learned that the process as you describe is "as designed". However, there are stratigies for minimizing the downsides.
For more information, please see the following documents:
AIR 2.6 Extended Migration Signature Grace Periods
Update Strategies for Changing Certificates
Update Your Applications Regularly
Code Singing in Adobe AIR
Hope this helps,
Chris

Thawte code signing certificate problem

Hi everyone!
I wonder if someone here could help me out a little bit?
I just received a code signing certificate from Thawte, but nobody mentioned that I should have enrolled it with Firefox (I have mac). So I used my default browser Safari. And now I can´t find any instructions how to change that certificate to a file that I can use in my Flex 3 when I export an AIR installer. All the instructions tell me to use Firefox, but it´s too late. I have to use same browser I have used earlier.
I send this answer to Thawte too, but I´m not sure when they answer...

Well, yes, apparently Keychain Access doesn't let you export the entire certificate chain.
See http://forums.adobe.com/thread/234000 for a post on essentially the same issue.
I haven't tried it, but maybe you can import the certificate into Firefox and then re-exported it with the entire certificate chain. Or do the same with the Java keytool utility. You could also set the ADT command line parameters to access the Mac Keychain directly, but then you couldn't use the built-in Flash/Flex Builder export. Those are the only options I can think of if you can't get help from Thawte.

Java security error after 8u31 (Timestamped Jarsigned Applet within valid period of Code Signing certificate)

Hello,
I have an applet running in embeddad systems. This program runs without any problem since 8u31 update! After this update it starts to give java security warning and stops running.
Here is the warning message:
"Your security settings have blocked an application signed with an expired or not-yet-valid certificate from running"
What it says is true; my Code Signing Certificate (CSC) is valid between 24 Jan 2014 and 25 Jan 2015. And it expired! However, while i was signing my applet with this certificate i used "timestamp". The authority i choosed was DigiCert. My signing date was 26 Jan 2014 (when my CSC was valid).
When i started to have this Java Security Error, first i thought i mis-timestamped my code, and check by using the jarsigner -verify command. Here is a partial result:
s      19607 Mon Jan 27 13:17:34 EET 2014 META-INF/MANIFEST.MF
      [entry was signed on 27.01.2014 13:19]
      X.509, CN=TELESIS TELECOMMUNICATION SYSTEMS, OU=ARGE, O=TELESIS TELECOMMUNICATION SYSTEMS, STREET=TURGUT OZAL BLV.NO:68, L=ANKARA, ST=ANKARA, OID.2.5.4.17=06060, C=TR
      [certificate is valid from 24.01.2014 02:00 to 25.01.2015 01:59]
      X.509, CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB
      [certificate is valid from 24.08.2011 03:00 to 30.05.2020 13:48]
      X.509, CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, ST=UT, C=US
      [certificate is valid from 07.06.2005 11:09 to 30.05.2020 13:48]
      X.509, CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE
      [certificate is valid from 30.05.2000 13:48 to 30.05.2020 13:48]
sm       495 Thu Jan 23 14:55:22 EET 2014 telesis/WebPhone$1.class
As you may see the timestamp was correctly done. And it is in the valid period of CSC.
Than i started to check how Java confirms the Certificate, and found some flowcharts.
Here is an example from DigiCert:
Code Signature Verification Process
After the Web browser downloads the Applet or Web Start application, it checks for a timestamp, authenticates the publisher and Certificate Authority (CA), and checks to see if the code has been altered/corrupted.
The timestamp is used to identify the validation period for the code signature. If a timestamp is discovered, then the code signature is valid until the end of time, as long as the code remains unchanged. If a timestamp is not discovered, then the code signature is valid as long as the code remains unchanged but only until the Code Signing Certificate expires. The signature is used to authenticate the publisher and the CA, and as long as the publisher (author or developer) has not been blacklisted, the code signature is valid. Finally, the code is checked to make sure that it has not been changed or corrupted.
If the timestamp (or Code Signature Certificate expiration date) is verified, the signature is validated, and the code is unchanged, then the Web browser admits the Applet or Web Start application. If any of these items do not check out, then the Web browser acts accordingly, with actions dependent on its level of security.
So according to this scheme, my applet had to work properly, and without security warning.
However i also found that from Oracle, which also includes the timestamping authorities Certification validity period??? :
The optional timestamping provides a notary-like capability of identifying
when the signature was applied.
    If a certificate passes its natural expiration date without revocation,
trust is extended for the length of the timestamp.
    Timestamps are not considered for certificates that have been revoked,
as the actual date of compromise could have been before the timestamp
occurred.
source: https://blogs.oracle.com/java-platform-group/entry/signing_code_for_the_long
So, could anyone please explain why Java gives security error when someone tries to reach that applet?
Here is a link of applet: http://85.105.68.11/home.asp?dd_056
I know the situation seems a bit complicated, but i tried to explain as simple as i can.
waiting for your help,
regards,
Anıl

Hello,
I have an applet running in embeddad systems. This program runs without any problem since 8u31 update! After this update it starts to give java security warning and stops running.
Here is the warning message:
"Your security settings have blocked an application signed with an expired or not-yet-valid certificate from running"
What it says is true; my Code Signing Certificate (CSC) is valid between 24 Jan 2014 and 25 Jan 2015. And it expired! However, while i was signing my applet with this certificate i used "timestamp". The authority i choosed was DigiCert. My signing date was 26 Jan 2014 (when my CSC was valid).
When i started to have this Java Security Error, first i thought i mis-timestamped my code, and check by using the jarsigner -verify command. Here is a partial result:
s      19607 Mon Jan 27 13:17:34 EET 2014 META-INF/MANIFEST.MF
      [entry was signed on 27.01.2014 13:19]
      X.509, CN=TELESIS TELECOMMUNICATION SYSTEMS, OU=ARGE, O=TELESIS TELECOMMUNICATION SYSTEMS, STREET=TURGUT OZAL BLV.NO:68, L=ANKARA, ST=ANKARA, OID.2.5.4.17=06060, C=TR
      [certificate is valid from 24.01.2014 02:00 to 25.01.2015 01:59]
      X.509, CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB
      [certificate is valid from 24.08.2011 03:00 to 30.05.2020 13:48]
      X.509, CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, ST=UT, C=US
      [certificate is valid from 07.06.2005 11:09 to 30.05.2020 13:48]
      X.509, CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE
      [certificate is valid from 30.05.2000 13:48 to 30.05.2020 13:48]
sm       495 Thu Jan 23 14:55:22 EET 2014 telesis/WebPhone$1.class
As you may see the timestamp was correctly done. And it is in the valid period of CSC.
Than i started to check how Java confirms the Certificate, and found some flowcharts.
Here is an example from DigiCert:
Code Signature Verification Process
After the Web browser downloads the Applet or Web Start application, it checks for a timestamp, authenticates the publisher and Certificate Authority (CA), and checks to see if the code has been altered/corrupted.
The timestamp is used to identify the validation period for the code signature. If a timestamp is discovered, then the code signature is valid until the end of time, as long as the code remains unchanged. If a timestamp is not discovered, then the code signature is valid as long as the code remains unchanged but only until the Code Signing Certificate expires. The signature is used to authenticate the publisher and the CA, and as long as the publisher (author or developer) has not been blacklisted, the code signature is valid. Finally, the code is checked to make sure that it has not been changed or corrupted.
If the timestamp (or Code Signature Certificate expiration date) is verified, the signature is validated, and the code is unchanged, then the Web browser admits the Applet or Web Start application. If any of these items do not check out, then the Web browser acts accordingly, with actions dependent on its level of security.
So according to this scheme, my applet had to work properly, and without security warning.
However i also found that from Oracle, which also includes the timestamping authorities Certification validity period??? :
The optional timestamping provides a notary-like capability of identifying
when the signature was applied.
    If a certificate passes its natural expiration date without revocation,
trust is extended for the length of the timestamp.
    Timestamps are not considered for certificates that have been revoked,
as the actual date of compromise could have been before the timestamp
occurred.
source: https://blogs.oracle.com/java-platform-group/entry/signing_code_for_the_long
So, could anyone please explain why Java gives security error when someone tries to reach that applet?
Here is a link of applet: http://85.105.68.11/home.asp?dd_056
I know the situation seems a bit complicated, but i tried to explain as simple as i can.
waiting for your help,
regards,
Anıl

Document signing requires code signing certificate

Prior to applying update 11.0.9 we could use more certificates to sign Reader Document. Now only Code signing certificates or ones with All Purposes work.
Our users do not have Code Signing certificates or ones with all purposes.
What changed? And how do I get my original certifcates working again for signing?

Hello Jeff,
The behavior change you've noticed with your certificates in version 11.0.9 is not a bug.
In version 11.0.9, Adobe introduced changes in the way digital certificates are filtered for signing.
The changes were made in order to align certificate use more closely with the spec, RFC 5280.
Starting in version 11.0.9, Acrobat/Reader filter off of the extended key usage (EKU) extensions in addition to the Key Usage (KU) extensions.
The certificate you mention with the EKU extension OID (1.3.6.1.4.1.311.10.3.12) is purposely filtered out.
Starting in version 11.0.9, certificates that are available for signing must have a Key Usage extension of digitalSignature or nonRepudiation. Or no KU extension.
If an EKU extension is present, it must have a value of emailProtection or codeSigning or anyExtendedKeyUsage (OID 2.5.29.37.0).
These changes are not present in the current release of Acrobat/Reader X 10.1.12.
Documentation on this topic is not yet available.
Regards,
Charlene

How to use Java code signing certificate in oracle 11i

Hello,
I am try to configure java code signing certificate in 11.5.10.2 application. we got java sign certificate from verisgin. SA's imported the certificate and created alias XXX_XXX with password and passphrase.
I am able to see the my certificate. keytool -list -v -keystore xxx_xxxx.jks -storepass Password.
how do I use it. I am using Enhance Jar Signing for EBS DOC ID 1591073.1.
could you please give me some advice on it?
Thanks
Prince

Hussien,
I find out apps keystore keypassword and storepassword, I imported the java code sign certificate. I generated Jar files through adadmin, but I am getting warning error
adogif() unable to generate Jar Filers under JAVA_TOP.
executing /usr/jdk/jdk1.6.0_45/bin/java sun.security.tools.JarSigner keysotre **** -sigfile CUST Signer /apps/......
Error JarSigner subcommand Exited With status 1.
No standard output from jarsigner JarSigner error output: Exception in thread "main" java.lang.NoClassDefFoundError: sun/security/tools/JarSigner Caused by: java.lang.ClassNotFoundException: sun.security.tools.JarSigner at java.net.URLClassLoader$1.run(URLClassLoader.java:202) at java.security.AccessController.doPrivileged(Native Method) at java.net.URLClassLoader.findClass(URLClassLoader.java:190) at java.lang.ClassLoader.loadClass(ClassLoader.java:306) at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:301) at java.lang.ClassLoader.loadClass(ClassLoader.java:247) Could not find the main class: sun.security.tools.JarSigner. Program will exit. WARNING: The following path(s), defined in /apps2/property/product/tst/appl/cz/11.5.0/java/make/czjar.dep as elements of the output: oracle/apps/cz/runtime/tag WARNING: Copying cztag.lst from the old fndlist.jar ... About to Analyze flmkbn.jar : Fri Nov 22 2013 10:45:51
Please let me know if you have any idea. Thanks Prince

Code Signing certificate expired

Hello,
I please need an information about SGDEE 4.1 login applet: it seems
applet code signing certificate was expired on September 2, 2005.
I have no problem (after I deleted all expired root certificates from
local client repository) with Internet Explorer 6SP1, but Mozilla Firefox
always prompt me a warning with this contents:
Serial:
[62374265099632433790334794162326322759]
Issuer:
N=VeriSign Class 3 Code Signing 2001 CA,
OU=Terms of use at https://www.verisign.com/rpa (c)01,
OU=VeriSign Trust Network,
O="VeriSign, Inc."
Valid From: Wed Sep 01 02:00:00 CEST 2004,
To: Fri Sep 02 01:59:59 CEST 2005
Subject:
CN="Tarantella, Inc.",
OU=Digital ID Class 3 - Netscape Object Signing,
O="Tarantella, Inc.",
L=Santa Cruz,
ST=California,
C=US
Thank you very much in advance,
Best Regards,
Valerio Morozzo

I know this is an older post, but it helped me find out how to make the migration procedure for native installer. I tried it with self signed certificate created by ADT tool and everything went fine.
But now, we obtained a commercial AIR signing certificate from Thawte and the process failes in step 3) ADT saying
'Certificate in PATH_TO_P12 could not be used to sign setup.msi' on Windows.
On mac, it says that signing native installer on OSX is not supported, so I skipped the signing option in step 3) and it worked fine.
I can skip the signing option on Windows as well and the process succeeds, but running the installer on machines with previous versions of application results in "Installer mis-configured' error message - the same error as if the migration process was not applied.
I already contacted Thawte if it is a certificate issue, reply from them was 'AIR certificate can only sign .air applications'. But when I build a native application directly from FlashBuilder and sign it with the Thawte certificate the whole process seem to succeed. The application can be installed on machines without previous version of the application. Those who already have the older version get the 'Installer mis-configured' error message.
I want to mark out again, that the same process but with a self signed certificate created with ADT, is successfull and the application can be installer as an update on machines with older version of the app. So I assume the workflow is correct.
Any ideas? Or somebody having the same issue?
Thanks

Code Signing Certificate

Generate a Code Signing Certification using he openssl application:
* Generate code signing key
* Generate code signing certificate request
* Generate code signing certificate
please can you help me in finding the commands for doing so plzzzzzzzzzzzzzzzzzzzzze

These are called "code signing certificates" and are emitted by "certificate authorities", such as VeriSign, Entrust, Thawte, Digicert, Comodo and many others.

Adobe code signing certificate revocation and SCCM

Similar Messages

Maybe you are looking for