Skip to main content

SQ20106

Detected expired digital signatures that have not been countersigned for time-stamping.

priorityCI/CD statusseverityeffortRL levelRL assessment
passmediummediumNoneNone

About the issue​

Digital signatures are applied to applications, packages and documents as a cryptographically secured authenticity record. Signatures are made using digital certificates, which can either be purchased from certificate authorities or be self-issued. Certificates have a validity period during which they can be used to create signatures. For application signatures, or digital code signing, it is recommended to countersign the signatures for time-stamping. Countersigned software components have their signature period validity extended past the signing certificate expiration date. Such signatures are considered valid indefinitely. We detected that the digital signature was not countersigned for time-stamping, and that the signing certificate has expired. Failing to countersign software components may result in application errors and availability outages.

How to resolve the issue​

  • Acquire a new certificate and re-sign the software component.
  • Apply the optional time-stamping countersignature during signing.
  • With Microsoft SignTool, you can specify the trusted remote time-stamping server using the /t or /tr parameter.

Incidence statistics​

ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes.

For every repository, the chart shows the percentage of projects that triggered the software assurance policy. In other words, it shows how many projects were found to have the specific issue described on this page.

The percentages are calculated from the total amount of packages analyzed:

  • RubyGems: 174K
  • Nuget: 189K
  • PyPi: 403K
  • NPM: 2.1M