Does an Old Install File Still Work After Code-Signing Cert's Expiration?

[msl58]

Hi,

I have some InDesign Extension ZXP install files, which were signed by a code signing cert from DigiCert, which is just now expiriaing. I signed with this parameter in the "ZXPSignCmd.exe" command

-tsa http://timestamp.digicert.com

 In theory, I understand that the ZXP file will always be installable into the future (assuming the cert was valid on the day in which the ZXP was originally created). But has anyone actually tested this theory? In the past, this did not work for us.

Does anyone have any experience with this that they could share, please?

TIA,

msl58

[Eugene Tyson]

@Vivek12 do you know about this one?

[HARSHIKA_VERMA]

Hi @msl58, 

Thank you for your patience. I checked with the team, and they mentioned that, yes, an Old Install File Still Works After the Code-Signing Cert Expires. When the actual signing happens, the cert must be valid at that time. Later, it checks the timestamp when the signing happened. If that lies before the cert expires, it is a valid binary.

Thanks,

Harshika