3

I'm trying to code sign my software and I am having issues because of the timestamp server. The certificate is from StartSSL. I'm getting an error which is shown below:

$ signtool sign /tr "http://www.startssl.com/timestamp" /f certfile.p12 /p password File.exe

SignTool Error: The specified timestamp server either could not be reached or returned an invalid response.

SignTool Error: An error occurred while attempting to sign: File.exe

Number of errors: 1

It appears the problem is the timestamp server is down for maintenance because when I try to login to startssl.com, it says Some of our services are offline and under maintenance during the night hours on weekends until 7:00 AM GMT in the morning. We apologize for the temporary inconvenience and thank you for your understanding..

Since there's nothing I can do about this and I don't know much about timestamp servers, I'm wondering if I can use another timestamp server (like http://timestamp.verisign.com/scripts/timstamp.dll or http://timestamp.comodoca.com/authenticode) to sign my code with? If so, are there any problems with using another timestamp server?

SameOldNick
  • 2,397
  • 24
  • 33

2 Answers2

3

Using StartSSL's "StartCom Tool", it appears that the timestamp server URL for Authenticode is http://tsa.startssl.com/timestamp.

That URL works for me when used in Visual Studio 2015 to sign ClickOnce manifests.

SvenAelterman
  • 1,532
  • 1
  • 15
  • 26
1

No it seems many people use verisign if their CA doesn't have their own timestamping server or Microsoft authenticode doesn't support the timestamping server the CA provides (It seems the Startssl timestamp server is not supported) see discussion on the startssl forum

Aussie Ash
  • 1,276
  • 12
  • 10