How do you deploy your own Authenticode Timestamping Service?

You need to write a custom HTTP Timestamp server. It should follow RFC 3161 Time-Stamp Protocol (TSP) rules.

When you sign your DLL for authenticode with a tool such as Signtool.exe from the Windows SDK, you can specify the url of the timestamp server (with the /t swich. See also /tr and /td). You would then point to your server.

See here on SO for a related question: Trusted Timestamps - understanding the format (rfc3161)

and also: Alternative timestamping services for Authenticode


You can develop your own timestamping service. You can write TSP (RFC 3161) server but Authenticode doesn't use RFC 3161 but PKCS#7/PKCS#9 formats as described in MSDN article (which you can implement as well). Our SecureBlackbox components include timestamping server component which supports both formats. Update: recent updates to Authenticode use standard RFC 3161 timestamps.

But the problem is to get the certificate which you will use to sign timestamps. This certificate must be issued by one of the CAs and as I understand, there exist severe requirements regarding management and infrastructure aspects of running a timestamp server. In particular you need to have a secure timestamping hardware. I didn't dig deep into this question, but these aspects are much more complicated then writing a piece of code.

Still if you run your own PKI infrastructure (have your own trusted root certificates and CA certificates), then the problem of having a trusted timestamping certificate is solved automatically - you can generate your own certificate.


You can set up your own Time-stamping Authority (TSA) supporting Authenticode time-stamps (and/or RFC#3161) using SignServer.

See https://www.signserver.org for the download and the installation instructions. In summary the important steps are:

  1. Make sure you have the pre-requisites:

    • Java
    • An application server (i.e. WildFly)
    • Apache Ant for deploying

  2. Download the 4.0 release from https://signserver.org or https://sourceforge.net/projects/signserver/files/signserver/4.0/ .

  3. Configure application server

    • For HTTPS (optional)
    • To make web services work
    • Patch with the latest security fixes

  4. Configure SignServer deployment

    • Set database.name=nodb and database.nodb.location=/an/empty/folder/as/db in conf/signserver_deploy.properties

  5. Deploy SignServer

    • export APPSRV_HOME=/opt/wildfly-9/
    • bin/ant deploy
    • Start application server /opt/wildfly-9/bin/standalone.sh

  6. Check that server started

    • bin/signserver getstatus brief all

  7. Setup a crypto token

    • bin/signserver setproperties doc/sample-configs/keystore-crypto-configuration.properties
    • bin/signserver reload 1
    • bin/signserver getstatus brief all

  8. Setup a sample time-stamp signer

    • bin/signserver setproperties doc/sample-configs/qs_timestamp_configuration.properties
    • bin/signserver reload 2
    • bin/signserver getstatus brief all

  9. Test the time-stamp signer

    • bin/signclient timestamp http://localhost:8080/signserver/process?workerName=TimeStampSigner

Tags:

C#

Dll

Code Signing

Trusted Timestamp

Recent Posts