Does an Old Install File Still Work After Code-Signing Cert's Expiration?

Question

Hi,

I have some InDesign Extension ZXP install files, which were signed by a code signing cert from DigiCert, which is just now expiriaing. I signed with this parameter in the "ZXPSignCmd.exe" command

-tsa http://timestamp.digicert.com

In theory, I understand that the ZXP file will always be installable into the future (assuming the cert was valid on the day in which the ZXP was originally created). But has anyone actually tested this theory? In the past, this did not work for us.

Does anyone have any experience with this that they could share, please?

TIA,

msl58

Harshika Verma · Answer

Hi @msl58,

Thank you for your patience. I checked with the team, and they mentioned that, yes, an Old Install File Still Works After the Code-Signing Cert Expires. When the actual signing happens, the cert must be valid at that time. Later, it checks the timestamp when the signing happened. If that lies before the cert expires, it is a valid binary.

Thanks,

Harshika

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.