Hacker News Reader

I'm not an expert on code signing, but wouldn't a code-signing cert with a 2 year lifetime mean that none of the apps it signs can be used for more than 2 years? Or is the code-signing valid as long as the signature was generated within the signing cert's lifetime?

View on HN

The latter. Code signing relies on a timestamping service to certify that the signature was made within the certificate's lifetime.

That assumes that the time-stamping certificate isn't revoked (not expired, revoked).

Code signing is a mess.

Same problem as for document signatures, one needs a trustworthy timestamping service certifying the time of signature, so the client may check if the whole certificate chain might have been valid at the time. This means that you need far more extensive CA and revocation databases than for TLS, because you need to keep all that historical data.

Reply on news.ycombinator.com