Last update: 20 April 2023 (gs)
A digital code signature, or code signature for short, validates that a program file has been published by a specific developer and has not been changed since then by providing the following information:
The attached countersignature verifies that the signing of the program file occurred at a specific time and date with a specific code signing certificate, that way it is possible to verify that a code signature was created with a valid code signing certificate.
This is achived by signing the following information with a time stamping certificate from a trusted Certificate Authority (CA):
Because of the countersignature by a trusted Certificate Authority (CA), the operating system is able to validate that the code signing certificate used to sign the program file was valid at the time of the creation of the signature.
Furthermore the intended purpose of the expiration of the code signing certificate, is still observed, since it still enforces a relatively small period of validity for any given signature key, as a precaution in case of theft of that key.
The purpose of expiration dates on certificates is to reduce the usefulness of any potentially stolen signing key, by forcing the thief to show their hand early, before the stolen key becomes useless.
This rotation of keys is very important for things like webservices because they continually issue new signatures potentially every few microseconds, without any way to verify if the signing key is still only in the possession of the service provider at that time.
But the countersignature on a code signature proves exactly that point, even if a thief gains access to a code signing certificate after it has expired, they can’t forge or modify an existing code signature because of the following properties: