[Usage-Help] Verfication fails on Windows every time about osslsigncode

[olszomal]

Download CA certificate file Microsoft Root Certificate Authority 2010 from PKI Repository - Microsoft PKI Services

Convert it from DER to PEM format:

openssl x509 -inform DER -in MicRooCerAut_2010-06-23.crt -outform PEM -out MicRooCerAut_2010-06-23.pem

It works:

osslsigncode.exe verify -in C:\Windows\explorer.exe -CAfile MicRooCerAut_2010-06-23.pem
(...)
CAfile: MicRooCerAut_2010-06-23.pem
CRL distribution point: http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl
Use the "-TSA-CAfile" option to add the Time-Stamp Authority certificates bundle to verify the Timestamp Server.
Timestamp Server Signature verification: failed
Signature verification: ok

Number of verified signatures: 1
Succeeded

More precisely:

osslsigncode.exe verify -in C:\Windows\explorer.exe -CAfile MicRooCerAut_2010-06-23.pem -TSA-CAfile MicRooCerAut_2010-06-23.pem
(...)
CAfile: MicRooCerAut_2010-06-23.pem
TSA's certificates file: MicRooCerAut_2010-06-23.pem
CRL distribution point: http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl
TSA's CRL distribution point: http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl

Timestamp Server Signature verification: ok
Signature verification time: Mar  9 11:50:20 2023 GMT
Signature verification: ok

Number of verified signatures: 1
Succeeded