What happens when a code signing certificate expires?

What you should do if you plan to use it in a closed (LAN) environment is to setup your own CA. Windows Server versions include easy to use Certification Authority but even easier is to setup a minimal CA by means of the demoCA provided by openssl, which consists of several scripts. You can run openssl demoCA in Cygwin on Windows or natively. This demoCA consists of several perl/bash scripts that call openssl commands to generate requests, sign certificates/crls, etc.

When you have your own CA what you need to install is your CA root certificate so there will be no more hassles to update user certificates since the CA certificate will stay the same. Typically a CA certificate should last for 5-10 years, but you can configure as much as you want (remember that it is your own CA).

The CA certificate will be installed on every client machine. If your application trusts Windows System security it should be installed on IExplorer Certificate Authorities keystore. If you use a Java Application then you should distribute the CA certificate inside the Java keystore you use.

Just had this problem. I found in this article the explanation and together with @BCran's answer I solved it. Summary:

• The certificate, by default, needs to be valid during validation (when the client opens the program, not during compile time)
• For the certificate to be valid forever, you need to sign the program using a TimeStamping server. That validates that you haven't changed your computer's time and used an old certificate. If you use a TimeStamping server, you won't need to resign your code every time.

This is how you would do it in VS.NET 2017 for example:

If the URL doesn't work, you can use any service, here are a bunch of URLs that work: https://stackoverflow.com/a/9714864/72350

BEWARE WINDOWS DEFENDER.

You never want your cert to expire, or as long as possible, which seems to be 10 years.

Once your cert expires, windows will not recognize a replacement cert as such. Your applications goes to the end of the queue, as if it was signed by a completely different organization.

This means that users will get nasty messages if they download, and may not be able to run your code at all depending upon group policies. This will continue until a large number of different people have ignored the dire warnings and installed your software.

Sure, a timestamp server will enable existing programs to run after the cert expires, but upgrades will be a problem.

This is not an issue for locally used software, but a big issue if you want to distribute your software widely.

BCran wrote: "The reason code signing certificates are so expensive is that someone has to verify that you are who you say you are."

Call me stupid, but has anyone thought of the idea that developers can do their own calculating of the exact size of their executable apps at time of being built and whether or not to include a developer's identity with the calculated number, insert the hash number in encrypted form with the app, and decide whether or not to time-limit the app or make it work in perpetuity (since the executable code already on a user's machine is unlikely to deteriorate or change on its own after 1, 3, 5, 10 , 100, 1 million years)?

Furthermore, it doesn't make any difference if someone can verify your phone number and/or address. Those things can change very easily if a developer chooses, but not the app's code.

Advantage: It costs nothing to the developer to perform this task. At the same time, users can still be assured of a valid and safe app for as long as they wish to use it (or allowed to use it by the developer) and the app remains untampered with. Or must the big players, such as Apple and Microsoft and certificate issuers, cajole developers into accepting to pay continuously for this service?

NOTE: My naive and original understanding of a code-signed app is to prevent tampering of the app's code by anyone. But the more I look at this, it looks more like it is an opportunity for third-party individuals and organisations to make money off of developers, from the rich and not so rich. Okay, someone has to do the work of trying to find out you are who you are. But the vast differences in prices I see across the internet for this service and so much emphasis on 1 or 3 year periods with no option of a perpetual lifetime signed app suggests that we have people out there with very expensive offices in the city to pay their rent and their hefty salaries.

Why don't developers demand the type of security solution from Apple and Microsoft that is far friendlier on the developers' pockets and just as secure and safe for the users? Or else give the exact size in bytes of the final installer file on the developer's web site at time of download and users can check. Any extra or loss of bytes from what's stated should be enough to tell users there is a problem. Force developers to have their own web site so everyone can see who they are and where to get a legitimate and untampered copy of the software and put an end to software download sites grabbing copies of the developer software to download from their sites. Everything should be done from the developer's site and no where else.