About code-signing timestamping
1. What timestamping is
A timestamp server provides an accurate, trusted time service to confirm the existence of data before a certain time and the relative order of operations, forming a time-based basis for non-repudiation. It attaches a time mark from a trusted source to the data and protects that mark's integrity and authenticity with a digital signature, drawing time from an authoritative source so all records share one time base.
2. The problem it solves
In a PKI, digital signatures prove the signer's identity and detect tampering. But signing certificates have a lifecycle and may be revoked within it. To prove a signature made during the valid period is still valid, an electronic timestamp is needed — establishing whether the signature happened before or after revocation, before or after expiry.
3. Code-signing timestamps
Code-signing certificates last 1-3 years, but software lifecycles are longer. To avoid re-signing and re-releasing when the certificate expires, use timestamping. When you sign with a timestamp, the code's hash is sent to the timestamp server for counter-signing. When users download the signed code, the system checks:
- code signed with a revoked certificate is not trusted;
- code signed with a valid certificate stays trusted even after the certificate expires.
So you needn't worry about re-signing after expiry. Timestamping is a free companion service — code signed within the validity period keeps working after expiry; in theory such signatures never expire. Without a timestamp, an ActiveX control signed with a now-expired certificate triggers a Windows warning and is blocked as if unsigned. Keep the signing machine online and add a timestamp when signing.
4. Recommended timestamp server
DigiCert timestamp server: http://timestamp.digicert.com
signtool sign /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 app.exe