Usually, the encoding of characters and strings in certificates is not a topic of great interest to the users of a PKI. However, there are cases where the default settings of the certification authority do not provide the desired results.
Today went through many Media that some apps and components in the recently released Windows 11 no longer work since 01.11.2021 and that the cause for this is a certificate that expired on 31.10.2021. In the meantime Microsoft has pointed out in a blog post and also published a patch for some affected components .
Unfortunately, none of the available sources provided detailed information about what exactly the problem was. So let's get to the bottom of this ourselves.
Assume the following scenario:
"Error: SignerSign() failed." (-2147024885/0x8007000b) One way to perform code signatures is to use the SignTool command line tool. This is part of the Windows 10 Software Development Kit (SDK).
If you want to use the tool on a system without having to install Visual Studio or the Windows SDK, you can proceed as follows.
Continue reading "SignTool installation without Windows Software Development Kit (SDK) installation"
Below is a description of the options available for executing PowerShell script files, and what is possible by signing them.
By default, the Microsoft Certification Authority removes the serial numbers of expired certificates from the revocation lists it issues.
However, there are some exceptions to this.
Continue reading "Treatment of expired certificates when issuing certificate revocation lists"