Validating digital signatures successfull on Win7 but fails on Vista/XP/W2K3

Microsoft has announced (Security Advisory 2880823: Recommendation to discontinue use of SHA-1) that
they will stop recognizing the validity of SHA-1 based certificates after 2016. Microsoft started to sign their files with digital signatures which use the stronger SHA-2 hashing algorithm. For the countersignatures (Time Stamping Authenticode Signatures)
they also use SHA-256. These certificates can be validated fine on Windows 7/8 but can't be validated on Windows Vista, Windows XP and Windows Server 2003R2. The status of certificates in the Certification Path are OK but on the older operating systems the
countersignature seem to be missing... See the forum thread
EMET 4.1 Update 1: 'The digital signature of the object did not verify.' on Vista/XP in the
Enhanced Mitigation Experience Toolkit (EMET) Support Forum for several screenshots.
Can someone explain this behavior and maybe provide a solution?
W. Spu

Hi,
It looks like it is related with this
https://technet.microsoft.com/library/security/2749655
This issue might be caused by a missing timestamp Enhanced Key Usage (EKU) extension during certificate generation and signing of Microsoft core components and software.
Microsoft is aware of an issue involving specific digital certificates that were generated by Microsoft without proper timestamp attributes. These digital certificates were later used to sign some Microsoft core components and software binaries. This
could cause compatibility issues between affected binaries and Microsoft Windows. While this is not a security issue, because the digital signature on files produced and signed by Microsoft will expire prematurely, this issue could adversely impact the ability
to properly install and uninstall affected Microsoft components and security updates.
So have you applied this update on XP\Vista\Server 2003?
http://support.microsoft.com/kb/2749655
This update will help to ensure the continued functionality of all software that was signed with a specific certificate that did not use a timestamp Enhanced Key Usage (EKU) extension. To extend their functionality, WinVerifyTrust will ignore the lack of
a timestamp EKU for these specific X.509 signatures.
Yolanda Zhu
TechNet Community Support

Similar Messages

No Valid Digital Signature

I'm trying to install the latest Itunes, but my computer won't let me becuase it keep saying that the publisher is unknown and the file was blocked becuase it does not have a valid digital signature that verifies it's publisher. I have no clue what to do. I have a Windows XP system.

These can be frustrating.
Try restarting your PC.
Using a different browser.
There have been reports that this can be due to router problems.
A simple way round it is to get a friend to download the installer for your and put it on a USB stick.

Install blocked does not have a valid digital signature verifying publisher.

Windows XP blocked the install. Error message was:
Unknown Publisher. Does not have a valid digital signature that verifies its puiblisher.

That suggests that the installer is getting damaged during the download.
I'd first try downloading an installer from the Apple website using a different web browser:
http://www.apple.com/itunes/download/
If you use Firefox instead of IE for the download (or vice versa), do you get a working installer?

I can't affix my valid digital signature to adobe reader pdf document?

I can't affix my valid digital signature to adobe reader pdf document. When the signature field is clicked, it is not showing my digital ID so that I can sign with it. Why it is not displaying my valid digital ID?

What is your operating system? What is your Reader version? What means "can not"?
Can you post a screenshot of such a message "to buy Adobe XI"?

"valid digital signature" required????

I am trying to download a poker website that i have been using for years and i now get a message saying "...valid digital signature missing...". I don't understand. I would appreciate any help. Thanks

Sounds like your security settings for their site are missing - such as might happen when you delete temproary Internet files and cookies.
Best bet would be to call their support number.
If you have a secure password... then you can use the "unable to view secure web sites" steps in this document to "reset" secure connections:
http://h10025.www1.hp.com/ewfrf/wc/document?cc=us&docname=bph07138&dlc=en&lc=en&jumpid=reg_R1002_USE...
... an HP employee expressing his own opinion.
Please post rather than send me a Message. It's good for the community and I might not be able to get back quickly. - Thank you.

Valid Digital signature - error downloading

Itunesetup.exe was blocked because it does not have a valid digital signature that verifies its publisher. How do I get around this?

My neighbor had this problem with her Dell laptop using the operating system Vista. I just installed the service pack 1 and it was able to successfully get Itunes to install.

Cant Download Firefox because it has no valid digital signature

When I try to download firefox 4.0 I can either run or save the setup file, when I "Run" I get an error message saying I cannot download because the creator (FireFox) has no valid digital signature, when I download the setup file to my desktop and try to run from there I get the error telling me the file is Corrupt?

ok no problem so what i did was i went to the cmd prompt and typed in ipconfig( to get there on vista type cmd in the search in the start window then press enter, in xp type cmd in the run box.) when you press enter you will then need to scroll down and check out what your ip address is. proper ip addresses end in something like ...1.1 or 0.1 if it has any other number then that you need to reset your ip address in your network settings which can be accesed in control panel. and if you have the option click the box that says get ip address automatically. hope that works!

Can't open PDF. Program does not have valid digital signature. No valid Acrobat S/N found.

I recently bought new HP computer with Windows 7. I loaded my Adobe Creative Suite 2 Premium. Illustrator tries to open then just disappears. I can not open PDF's. Get the following message: This program doesn't have valid digital signature that verifies it's signature. No valid Acrobat S/N found. Acrobat will now quit. Then: There is a problem with Adobe Acrobat/Reader. Please exit and try again. When I exit - computer locks up.

These can be frustrating.
Try restarting your PC.
Using a different browser.
There have been reports that this can be due to router problems.
A simple way round it is to get a friend to download the installer for your and put it on a USB stick.

TS3212 I have removed my pop-up blocker completely and still receive the following error message when attempting to download iTunes: "The file was blocked because it does not have a valid digital signature that verifies its publisher".....any ideas?

have removed my pop-up blocker completely and still receive the following error message when attempting to download iTunes: "The file was blocked because it does not have a valid digital signature that verifies its publisher".....any ideas?

That suggests that the installer is getting damaged during the download.
I'd first try downloading an installer from the Apple website using a different web browser:
http://www.apple.com/itunes/download/
If you use Firefox instead of IE for the download (or vice versa), do you get a working installer?

ServerAdmin and Valid Digital Signatures

How does one setup an XServer so that it issues a valid digital signature?
I'm attempting to enforce a requirement for valid digital signatures within ServerAdmin.
Any help or pointers to relevant documentation is greatly appreciated.
Thanks,
Carl.

OK, a little more digging around reveals some information on page 147 of the Server Administration Manual.
For the moment, this looks like my question has been answered!?
Carl.

Acrobat 9 and Validating Digital Signatures

I'd heard that Acrobat 9 had found a way to eliminate the problem of sending your certificate to everyone who needs to validate your signature on a form, but I haven't been able to prove that. I'm testing 9 and so far the only difference I see is that instead of seeing an icon next to the signature stating that it can't be validated, it now states it in a bar across the top of the document. Has anyone else found something different?
Thanks!
Anita

For a signature to be considered valid, there must be a "trust" relationship between the validator and the signer. So if I sign a document and claim to be be "Bill Clinton", the signature doesn't show as valid unless you've established that I really signed the document using Bill Clinton's credentials. Public key cryptography provides this assurance by signing using a private key and publishing a public key that can be used to verify that the real private key was used. But you have to have that public key, and that is what is distributed and "trusted" within Acrobat or Reader.
In Acrobat 8, there are basically 2 ways to get that trust relationship: 1) Exchanging certificates with people you trust or 2) purchasing a certificate from an Adobe partner that sells pre-vetted and trusted certificates (where you have to do some work to prove you are who you say you are). These certificates have a trust relationship pre-built into Acrobat so you don't have to set up trust.
In Acrobat 9 there are 2 new mechanisms for establishing trust, but they facilitate, but not eliminate the need to establish trust.
First, you can create a security settings file which includes trust relationships and distribute it to your group either in an ad-hoc way (email, etc.) or by posting on a server and having Acrobat or Reader automatically load the settings. This makes it easier to set up signature workflows in a small group or enterprise environment.
Second, there is a new way for establishing large scale trust for digital identities issued by large organizations such as government agencies or countries where these will also have trust automatically managed by Acrobat and Reader.
The new features are described in http://www.adobe.com/devnet/acrobat/pdfs/sharing_security_settings_90.pdf

Acrobat is not validating digital signature

Hi Everybody...
I have generated a pdf file which includes digital signatures.
But the acrobat is not validating the digital signature. But if
we open this file in PDF-xchange viewer, it shows that the
signatures are valid. Acrobat generates the following error...
Error during signature verification.
Signature contains incorrect, unrecognized, corrupted or
suspicious data.
Support Information: SigDict /Contents illegal data
What may be the problem?

Thank you Bernd for your kind and simple reply
I am uploading my file with my certificate which i am using for my digital
signatures. Please have a deep look at contents entry. Use ASNVIEWER or
decoder etc......
Thanks again and Best Regards

Valid Digital Signatures

I would like to know of a way to automatically validate a Digital Signature that comes from the same certificate store as me.
Say the root of my certificate is: MyCompanyCA
If someone sends me a signed document the block comes in as a question mark instead of the green checkmark.
I have to manually go and trust the certificate from that person to make it green. Is there any way I can just trust ALL certificates from MyCompanyCA?
So if a new person sends a signed, valid document, it will contain a green checkmark instead of a question mark.
I am running Acrobat 8.
Thank you.

Hi,
The short answer to your question is yes.
If you make the root CA certificate (or any of the intermediate CA certificates) the trust anchor, then all signatures created using digital IDs that chain up to that certificate will be valid (providing all other requirements are met). You can either add the root CA to the Acrobat/Reader Manage Trusted Identities list, or you can add them to the Windows Certificate Store, but in that later case you also need to set the preference to accept trust from Windows (and obviously, this isn't available on Mac or Linux).
Steve

Validating digital signatures. NEED HELP ASAP!

I emailed a form to an employee, who created and applied a digital signature to it. The form was emailed back to me and I received the message 'At least 1 signature requires validating/validation." I go through the steps to trusting and validating, yet when I reopen the document after saving it, I keep getting the same message to validate.
Please help!

When you contacted Canon what did they say?

Validating Digital Signature

How do I validate the digital signature ? Looks like the digital signature is added to the Trusted Identities. But there is a message displayed as "Selected certificate path has errors - Invlid Signature". What do I do to validate ? The sender of this document says that the problem is with my system and they are able to get it right.

Reader is all that is needed to validate signatures. It sounds like you have not established a trust relationship with the signer successfully. In Reader, go to Document > Manage Trusted Identities and then select the Certificates display. Is the signer or the issuer of the signer's certificate listed there? If not, you need to add it. If so, click on it a select Edit Trust... The "Use this certificate as a trusted root" box needs to be checked (Acrobat/Reader 9) or "Signatures and as a trusted root" (Acrobat/Reader 8).
If the desired certificate isn't listed, the easiest way to add it is, from the signature, right click show signature properties, Click Show Certificate. From there, select the cert (or its parent or issuer), then click the Trust tab, then click Add To Trusted Identities. Be sure the trusted root checkbox is set before clicking ok a bunch of times.

Validating digital signatures successfull on Win7 but fails on Vista/XP/W2K3

Similar Messages

Maybe you are looking for