0

In accordance with Microsoft a minimum key length for a certificate should be of 1024 bits since August 2012. I have created a self-signed certificate having a key length of 4096 bits. But the certificate information shows the following error:

The integrity cannot be guaranteed

When I inspected the public key length it shows the following screen:

Public key length

But instead of having "This certificate is OK." as a status, I am getting the following error:

Invalid digital signature

How can I resolve this issue?

Thanks...

Niladri Sen
  • 63
  • 1
  • 10

2 Answers2

1

Where do you see a self-signed certificate? Self-signed certificate is the certificate where Subject and Issuer fields are the same. In your case, it is not self-signed.

I can suspect, that the certificate was either, not signed by InfoValley Inc., or signature algorithm is not recognized on your system. Can you tell us the following information:

  1. Authority Key Identifier extension value from leaf certificate
  2. Signature algorithm used to sign leaf certificate (2nd and 3rd fields)
  3. Subject Key Identifier extension value from InfoValley Inc. certificate
Crypt32
  • 12,850
  • 2
  • 41
  • 70
  • Probably the private key of the certificate itself was used for signing, but the issuer is incorrect. That would result in the above error a the public key and private key would not match. – Maarten Bodewes Nov 08 '15 at 21:21
  • @CryptoGuy timestamp...info is not a self-signed but the top most is. 1. AKI extension: `KeyID=c1 30 17 9c 5f bb 1e a2 49 36 19 e2 ce b5 74 94 f5 d6 18 4a Certificate Issuer: Directory Address: E= CN=Innovation Mission OU= O=Niladri Sen Inc. S=West Bengal C=IN Certificate SerialNumber=10 00` 2. Signature algorithm: `sha1RSA` 3. SKI extension: `c1 30 17 9c 5f bb 1e a2 49 36 19 e2 ce b5 74 94 f5 d6 18 4a` – Niladri Sen Nov 20 '15 at 14:19
  • it appears that the certificate is really self-signed, but issuer and subject fields do not match. As the result, Windows reports error. – Crypt32 Nov 23 '15 at 06:05
0

I'll explain at least one other way that you can get an invalid digital signature that happened to me. I have a set of scripts that build may certificates and a set of scripts that installs certificates in the windows certificate store. The script that installs the certificates first deletes the certificates that I'm going to install and then installs the new certificates. I thought the script was working just fine, but it turns out I had little bug in the script. I have one Trusted Root CA certificate that is used to sign my Intermediary Trusted Root CA certificates. The problem was that I chose the wrong "certificatestorename" for the trusted root certificate. So, instead actually deleting my trusted root certificate before I installed it, I ended up creating a second trusted root ca certificate in the Trusted Root Certificate Authorities store with the same distinguished name. And that's what cause my 2nd level intermediary CA certificates to report that they had an invalid digital signature.

What made this problem a little difficult to spot was that if I looked at installed 2nd level intermediary CA certificates after being install in the windows certificate store, those 2nd level intermediary CA certificates all showed that the "This certificate is "OK" and no issues with the certificate chain. The problem caused by the two trusted root certificates with the same distinguished name didn't exhibit any problems until I tried to validate a certificate that was signed by one of my 2nd level intermediary CA certificates. It's when I look at those certificates that I saw my 2nd level intermediary CA certificates all had an invalid digital signature.

So, this is at least one way that I observed that you can get this error message. Technically speaking, the error means that the issuer of the certificate cannot validate the signature of the given certificate, which is not the same thing as not finding the issuer certificate in the trusted store. Others have reported that this problem can occur in windows if you generate a certificate whose key length is 512.

Tom Rutchik
  • 1,183
  • 1
  • 12
  • 15