3

I have a .Net executable which I have digitally signed using a certificate generated through makecert.exe and signed using signtool. How to verify that exe has not been tampered or it is still using the certificate digitally signed by me.

For ex - A situation where anyone can replace the exe which is digitally signed by another certificate and placed into Trusted Root Authorities.

From various internet sources I read that the below code would just check if the certificate is valid

           X509Certificate signer = X509Certificate.CreateFromSignedFile(executablePath);
            X509Certificate2 certificate = new X509Certificate2(signer);
            var certificateChain = new X509Chain
            {
                ChainPolicy = {

                    RevocationFlag = X509RevocationFlag.EntireChain,
                    RevocationMode = X509RevocationMode.Online,
                    UrlRetrievalTimeout = new TimeSpan(0, 1, 0),
                    VerificationFlags = X509VerificationFlags.NoFlag
                }
            };
            var chainIsValid = certificateChain.Build(certificate);
            if (chainIsValid)
            {}

And it is suggested to use WinVerifyTrust. My question is WinVerifyTrust would also validate the certificate, if the same exe is signed by another certificate deployed in Trusted Root Authorities. How can I associate the exe with my certificate? Or how the WinVerifyTrust can be helpful in this situation as mentioned everywhere? Please help!!

Thanks

user3323130
  • 109
  • 1
  • 8
  • do you mean you cannot trust windows? your question has some problem too: how to do make sure 'my certificate' is not replaced by someone else? do you manually open it? how to do you make sure the editor is not hacked? this is like a forever loop... – Lei Yang Mar 13 '19 at 12:16
  • So wouldn't you just validate the public key is what you expect? – stuartd Mar 13 '19 at 12:47
  • @LeiYang - I want the users not to update the executable file I am providing them Hence I am digitally signing my exe with a certificate.But suppose in some way if they tamper it and sign again with another certificate, how can I ensure/check if this is the same exe that is digitally signed by me – user3323130 Mar 14 '19 at 04:32
  • @stuartd - Can you be more specific. Any examples? – user3323130 Mar 14 '19 at 04:33
  • 1
    If the users can tamper with the exe file, they can just remove any certificate checks anyway. – stuartd Mar 14 '19 at 10:25

0 Answers0