Why does extension loader check extension's certificate during each loading?

Hello,
We are having some problems with an expired code signing certificate.
We sell a commercial extension which is signed with our code signing certificate. Recently our certificate expired, and we started to receive reports that our extension had stopped working in CS5.
It looks like CS5 checks the extension's certificate not only during installation, but also at each loading.
This behavior looks like a serious bug in Creative Suite extension loader since all certificates will expire sooner or later, and this means that all extensions are doomed to stop working at some point, unless they are timely updated.
Why does CS5 check the certificate at each start up? This doesn't make sense at all, certificates are only used to check that the code is authentic during installation. An authentic extension cannot turn into malware after installation, so there is absolutely no point in checking the certificate after installation.
Can someone from the CS SDK team comment on this issue? This turned into a major problem for us.
Thank you in advance,
Anatoly Paraev
PixelNovel 

Anatoly, let me summarise my thoughts/findings on this:
- Your extension's signature is invalid now that your certificate has expired (as you have reported)
- Your extension's signature is not timestamped with a timestamp certificate. A signature without a timestamp is only valid till the signing certificate expires. A signature with a timestamp is valid until the timestamp certificate expires, typically a much longer period.
     - As you can infer from this, Extension Builder does not create timestamped signatures and does not give any warning about this. Apologies that we failed to anticipate this problem during CS SDK and Extension Builder development. You will probably agree this is not good enough, and I have filed a bug (#2916071) to ensure this is dealt with in future releases.
As I mentioned earlier, extension signature validation is performed on extension load to ensure an extension's footprint has not been maliciously modified since installation. I think it is very unlikely that we can remove this signature validation for security reasons, nonetheless I've started a conversation about it internally and can let you know the outcome.
To help your users now, I think you will need re-sign and re-deploy your extension with a new certificate. So you can timestamp the signature, use ucf.jar in the Packaging and Signing Toolkitto sign the extension rather than Extension Builder. Pass the argument -tsa=<your_chosen_timestamp_server> to ucf.jar when signing and check the signature is timestamped

Similar Messages

  • Why does firefox 4 hang in some websites, during browsing on that site ? This never happened with previous editions.

    why does firefox 4 hang in some websites, during browsing on that site ? This never happened with previous editions. edit
    Details

    Start Firefox in [[Safe Mode]] to check if one of the add-ons is causing the problem (switch to the DEFAULT theme: Tools > Add-ons > Themes).
    * Don't make any changes on the Safe mode start window.
    See:
    * [[Troubleshooting extensions and themes]]
    Create a new profile as a test to check if your current profile is causing the problems.<br />
    See [[Basic Troubleshooting#Make_a_new_profile|Basic Troubleshooting&#58; Make a new profile]]<br />
    There may be extensions and plugins installed by default in a new profile, so check that in "Tools > Add-ons > Extensions & Plugins"<br />
    If that new profile works then you can transfer some files from the old profile to that new profile (be careful not to copy corrupted files)
    See http://kb.mozillazine.org/Transferring_data_to_a_new_profile_-_Firefox

  • Why does my Macbook Pro keep shutting down during installation of OSX Mountain Lion?

    Why does my Macbook Pro keep shutting down during installation of OSX Mountain Lion?

    Hmm, good luck then!
    I'm pretty much exactly on the opposite side of the planet, but I've been to Vermont and remember its rural beauty well. However, I can't imagine you having the only Internet connection within a reasonable radius (where "neighbors" hanging off the same ISP don't count). Uh, that note only if your wired connection to the router produces no good result, either...

  • Why does Adobe XI Pro keep appearing on screen each time I open a pdf file?

    Why does Adobe XI Pro keep appearing on screen each time I open a pdf file?

    Is this whatyou need?
    If  you uncheck this Acrobat Opens but the PDF will open without showing startup screen.

  • Why does itunes load cds in the wrong track order

    why does this happen and can it be sorted cheers

    iTunes imports CDs in track order, first to last.  iTunes displays these tracks in your music library based on how you select your library to be viewed.  For example, in list view you can select the "date added" column and see the tracks in the order they were imported (with the most recent on top).  You can select the name colum and see all the tracks in alphabetical order.  You can select the album column and see the tracks in album order.  The album column cycles from album, to album by artist, or album by artist/year as you click on the column title.
    See this for tips on various view options:  http://www.apple.com/itunes/how-to/#tips-viewoptions

  • Why does netflix load so slowly on 4g network.

    I have a verizon 4g lte router.  It has a very good data download speed.  When I perform a speedtest it comes in higher than 5.5 MBPS.  When I load from HULU it loads at about 2 MBPS.  However, often when loading from Netflix, it loads at less than 50 KBPS.    Any idea why netflix actually loads so slowly?  And if so, any Ideas on how to improve the rate?

        Hello PIequal
    That's a very strange issue. Let's get this fixed. I use Netflix all the time and never see that issue so I can see how this would be very frustrating.
    Which device do you have? What zip code are you in? Have you tried clearing the data and retesting?
    Please let me know so we can get to the bottom of this quickly.
    JoeL_VZW
    Please follow us on twitter @vzwsupport

  • Why does Dreamweaver load so many fonts at startup?

    On my Mac Pro I'm using Dreamweaver CS4, and FontAgent Pro for font management. When I try to close fonts I don't need or use, they seem to get re-opened whenever I open Dreamweaver; and they're fonts that aren't "web" fonts, like Big Caslon, Cochin, and Stone Sans Semi Italic. How can I tell DW that I don't want these fonts open? Does DW need them for itself?

    I guess I should have been more specific. I have many, many fonts — Open Type, Postscript, as well as True Type — all managed by FontAgent Pro. By "close", I mean deactivate in FontAgent Pro. FontAgent Pro does physically re-organize and move the System fonts out of the various Fonts folders to manage them (except for System/Library/Fonts ... it doesn't touch that folder.) And the fonts that Dreamweaver requests at startup (that are deactivated, only to be activated via FontAgent Pro's auto-activation) aren't standard system fonts, nor standard web fonts. So my question is, why does Dreamweaver need those fonts?

  • Why does a motion control unit constantly fail during config

    Why does a drive fail during config.... I am trying to control a machine using faulhaber motors (5 of them) with faulhaber controls, one drive fails during config (fatally fails) and it is not wired any different to any of the others... even with only 24v supply, it dies... Blue screen and restart of pc... the others all worked perfectly, with no fault. The process we are using for the troublesome drive is exactly the same... We are stuck, can anyone please help?

    thank you, but faulhaber are all on holiday, and I am really struggling..... tis only one unit and only when it is positioned in one place... checked all electrical connections, no shorts, no loose wires, even fails when just power and serial connected.... so not even motor problem.....

  • Why does aperture keep asking for my activation key each time I open the programme?

    I have aperture on iMac and macbook air - everytime I open aperture on air, it asks my name and key number. how do I get it to remember this? why does it do it?
    Help please - I am tired of it.

    Be sure to enter the serial number, when you are logged in from an account with Administrator priveleges - otherwise the serial number cannot be stored.
    Aperture is installed for all users on your mac, so the serial number is written to the system library, not the user library, and this requires read/write access for administrators. Do you enter your serial number using an administrator account?
    When did this start? Have you migrated your system from another mac? Then you still may have an older ProAppSystemID file  or Aperture cannot write to the System Library.
    To stop Aperture asking for the serial number, first check, if you still have an old file "ProAppSystemID" in your System Library.
    Quit Aperture.
    Go to your MacintoshHD and open the folder "Library", then "Application Support", then "ProApps".
    Remove the File "ProAppsSystemID" to the Desktop, if it exist and restart Aperture.
    Reenter your serial number, hopefully for the last time.
    Sometimes Aperture writes this file to a temporary directory, when it cannot write to the Library. If the above does not work, look at the temporary directory /tmp
    Use the Finder's "Go" menu
         Go > Got to folder    and  enter /tmp into the textfield. If you see the file there, move it to its proper location.
    Aperture must be running, and you will have to wait a few minutes to be seeing the file appearin the /tmp directory.
    In this case you may want to repair the permissions on your system drive; you can do this using the "First Aid" tools in "Disk Utility" (located in Applications > Utilities)
    Regards
    Léonie

  • Why does Extension Manager starts with Dreamweaver?

    I teach Dreamweaver at Barrington High School.  Extension Manager starts with Dreamweaver, which increases the time it takes to launch Dreamweaver.  Is there a way to fix this?  I've never had this issue on my laptop, only in the classroom computer lab.

    Hi Carey,
    It's Dreamweave for Windows (OS is Windows XP Professional Version 2002, Service Pack 3)
    The Dreamweaver version is CS5, Version 11.0, build 4993
    Thanks for looking into this.
    Mary Ellen

  • Why does Safari load each time I boot my computer?

    I like Safari alot, but I don't like how it loads by default every time I reboot my computer. Why is it doing this and how can I stop it?
    Thanks!

    It starts up because you probably have it listed as a Login Item for your account. You can check that by opening System Preferences > Accounts and click on the Login Items tab and look for it. If you see it there, select it and click the minus button to get rid of it.

  • Why does mainstage load every instrument for an entire concert at once?

    I have recently finished a UK tour using Mainstage at the centre of my keyboard rig and while I got through without any hitches, I had 30 songs to program in the run-up to the tour and almost all of them involved strings in some form or other (I use Omnisphere for this) - I ended up not being able to store them all in one master song list concert because the massive amount of memory needed by having 30 instances of Omnisphere meant that it would crash straight away. I got around it by splitting the list into two concerts but it was frustrating and slowed down the process of building sets for each gig while on tour. Also, this was a fairly simple tour to program for - if I did something else which was more intensive, I've no idea what I'd do!
    I know that in the West End they use Forte on their keys setups, and I am starting to see why....however, I love the interface of Mainstage (and the fact you can use it on a Mac!) and wish that Apple would address this issue asap! A setting that allowed you to choose whether to load the entire concert into memory on startup (a definite plus given the near-instantaneous patch change times if your Mac can handle it) or just to load one patch at a time would be great.
    Has anyone else found this to be a problem, and come up with any different workarounds? Is there anyone from Apple that checks these forums who could comment?
    Thanks
    Steve

    Thanks for the replies guys - seems this one is a bit of a contentious issue! In hindsight I could have used the string sounds at a higher level, although with most of the songs there were tweaks made to the patch because I was blending the Omnisphere with a rack Motif ES module in varying degrees as the song required. I will investigate aliases also - I was unaware of these!
    But I still stand by my original point, because it limits the possibilities of using Mainstage as a database of songs e.g. for a job where you have a lot of songs in the repertoire and will be creating a different set from these for most gigs. As I mentioned, it became impossible to open the master song list and transfer songs one by one to another Concert.
    And with the comment about 64 bit making the problem disappear....well, yes but that seems a bit ridiculous that all the powerful Macs around at the moment (mine being a top-spec late 2009 15" MacBook Pro) will have to 'lump it' with 'only' the 4GB available to them!! It should be plenty equipped to handle what I throw at it, and in the case that there are a lot of memory (or CPU) intensive plugins there should be the choice of whether to have the entire concert / set / song loaded into memory on startup.
    Again, I'd refer back to Brainspawn Forte, which seems like 'the' choice for most keyboard players and show programmers. There is minimal load lag, even when loading up very complex patches that in Mainstage's current form would have it eating up resources and crashing! I'm going to reluctantly investigate using Forte within Boot Camp, but still hoping that eventually Mainstage will mature into an even more flexible and intuitive program for live work - it has a great interface!

  • Why does gmail spell check highlight partial words?

    I recently received the latest version of Firefox for my Windows XP desktop computer. Since that time, when I type e-mails the spell check puts a wiggly red line under parts of a word. When I click to spell check the entire e-mail, parts of correctly spelled words are highlighted in yellow and the dictionary tries to provide spellings for these highlighted parts of each word. I have gone into Firefox options and unchecked the box for spell checking as I type. That did not help. What can I do to fix this problem?

    Hi,
    You can update Firefox via '''Help''' ('''Alt''' + '''H''') > '''About Firefox''', or from https://www.mozilla.org/en-US/firefox/new/
    [https://www.mozilla.org/en-US/firefox/update/ Updating]
    If you're using an add-on, you can try to '''Disable''' it in '''Tools''' ('''Alt''' + '''T''') > '''Add-ons''' > '''Extensions'''. Please note that Gmail has a spell check function, so if the problem persists, you may have to disable the Gmail spell check. The [https://productforums.google.com/forum/#!forum/gmail Gmail support] would also be helpful.
    [https://support.mozilla.org/en-US/kb/Using%20extensions%20with%20Firefox Using extensions]

  • Why does Labview load the vi.lib directory on start of a VI?

    I am using LABView 8.0.1 and when I start a VI, it looks as if LabView is loading items in the vi.lib directory.  Is this normal?  I would not be concerned if I was using these items, but I am not using any of the libraries that are being loaded.  Given the nature of the programming that I am doing, I need to see it I can stop Labview from doing this.

    I guess the nature of the programming is misleading.  It is more the environment.  I have to make sure that the VI is not calling/doing anything that could show up as an entry in the security log.  The things that i am concerned about are things like smtp mail.  Is there a way to stop labview from loading items like this?

  • Why does iMovie load every project when it opens?

    The genius that I talked to in the Apple Store said that I needed to save my projects.  But that does not seem possible.

    It happens to me too. I think you might have to delete the footage that you are working on once you have completed and saved your movie. I noticed that whenever i deleted a clip, it would not load back with the other clips whenever i relaunched iMovie.

Maybe you are looking for

  • Startrfc - how to call with "input table"?

    I have not been able to get sapnwrfc for Perl to compile correctly on my AIX systems so i want to try something different. I started to investigate using startrfc to get my data but am running in to a problem. Problem Summary:  I want to get informat

  • Oracle BPEL is not starting up for Weblogic 8.1.5

    I have installed Weblogic 8.1.5 and Oracle BPEL for Weblogic in D:. When I tried to start the Oracle WL BPEL, I get the following exception. <Dec 21, 2005 11:48:05 AM IST> <Notice> <Management> <BEA-140005> <Loading domain configuration from configur

  • URGENT ! Using Sun's J2EE RI Server with MS SQL Server 2000

    I'm using the J2EE Server that comes with the J2EE 1.3.1 package from Sun. I'm trying to load a datasource using the free MS SQL Server 2000 Driver for JDBC, but I'm always getting this error (I've run out of ideas so maybe someone in this forum can

  • Tree display not updating when adding first node to expanded node

    Hi Please have a look at the following code. To reproduce the faulty behaviour you have to expand the item, then click "add" button and observe, that nothing happens. Collapsing, then expanding the node shows the added children. I use Flex 3.5.0 Is t

  • ITunes not authorizing my purchased content on my ATV2

         I cannot get purchased content from iTunes to play on my ATV2 - Is there a specific way to authorize your ATV2?  I've signed in to my iTunes store account and iCloud account on ATV2, but they still won't authorize.  When I press play it starts "