wazuh / wazuh-packages

Wazuh - Tools for packages creation
https://wazuh.com
GNU General Public License v2.0
103 stars 93 forks source link

The signature in MSI package does not contain a timestamp #2752

Open rafabailon opened 8 months ago

rafabailon commented 8 months ago

Description

In certificates check it has been found that the signature in MSI package does not contain a timestamp.

Found in Scheduled certificates review - 2024 Monthly #01

image

Details

When it comes to digital signatures, timestamping refers to the process of including an electronic timestamp in your signature to possibly extend the validity of the signing certificate.

Therefore, if a certificate includes a timestamp, it will validate the certificate by verifying the signature against the time it was signed, and not the time you are running the software. And if not and a certificate has expired, then not having a digital signature timestamp will essentially block the application from being used.

Steps to Reproduce

To reproduce the error you must follow the following steps:

image

image

Tasks