The signing certificate or its chain could not be verified. Certificate subject

user_14595545 0
Viewed 123

when I commit I get this when I look at commits GitHub I get an unverified badge with this information:

The signing certificate or its chain could not be verified.

Certificate subject CN 0b91490c-3114-4147-be83-5ed82a5286fd Certificate issuer CN MS-Organization-Access OU 82dbaca4-3e81-46ca-9c73-0950c1eaca97

and when i run git log --show-signature i get

commit f37d79cd4201ec1300fc37ad3ce287be83485776 (HEAD -> main, origin/main)
smimesign: Signature made using certificate ID 
0x67790ffb3f432fa0cda03c4c303bb82afa71a7d1
smimesign: Good signature from "CN=0b91490c-3114-4147-be83-5ed82a5286fd"
Author: Malik Mouhiidine <malikprofessional2020@gmail.com>
Date:   Thu Jan 21 13:24:09 2021 +0100
so it has to be verified and when visiting the commits page on Github I 
find unverified on my commits

I didn't find anyone having this same problem, so if someone could help.

commit gnupg github git
1 Answers

Looks like you are using Gitsign.

GitHub doesn't recognize Gitsign signatures as verified at the moment:

The sigstore CA root is not a part of GitHub's trust root.

Because Gitsign's ephemeral keys are only valid for a short time, using standard x509 verification would consider the certificate invalid after expiration. Verification needs to include validation via Rekor to verify the cert was valid at the time it was used.

This information can be in the readme https://github.com/sigstore/gitsign

user_85562930
Related