Light

Episode #1060 Quiz

3-Day Certificates
Date: 2026-01-13 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

This episode explains code signing certificate changes, focusing on Microsoft's Azure Trusted Signing issuing short-lived three-day certificates to limit misuse if compromised. These certificates are paired with trusted timestamping authorities, which provide an unspoofable signing time, ensuring signature validity beyond certificate expiration.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to Rick Strahl's blog post discussed in the episode, what is a primary reason that modern code signing certificates must be stored as non-exportable either on certified online authorities or hardware security modules?

Question 1

According to Rick Strahl's blog post discussed in the episode, what is a primary reason that modern code signing certificates must be stored as non-exportable either on certified online authorities or hardware security modules?

To reduce the cost of certificate issuance by eliminating hardware tokens. To allow developers to easily transfer certificates between their devices. To prevent keys from being copied and misused by unauthorized parties. Because exportable certificates are no longer supported by modern operating systems.

Question 2: What pricing and usage model does Microsoft's Azure Trusted Signing service offer for code signing certificates as reported in the episode?

Question 2

What pricing and usage model does Microsoft's Azure Trusted Signing service offer for code signing certificates as reported in the episode?

A one-time purchase of a perpetual certificate with unlimited signing capabilities. A monthly subscription with a fixed number of signatures and additional charges per signature over the quota, with non-EV certificates. Annual EV certificates with unlimited signing count included in a lump sum payment. Free code signing certificates restricted to minimal usage and only for open-source projects.

Question 3: How does a Timestamp Authority (TSA) ensure that code signed with a short-lived certificate remains trusted long after the certificate's expiration?

Question 3

How does a Timestamp Authority (TSA) ensure that code signed with a short-lived certificate remains trusted long after the certificate's expiration?

By extending the certificate's expiration automatically upon each verification attempt. By embedding the public key permanently into the code binary, bypassing the need for a certificate. By providing a verifiable timestamp counter-signature certifying the exact signing time within the certificate's validity period. By reissuing the code signature each time the certificate expires to maintain validity.

Question 4: What is a significant operational challenge that Rick Strahl highlights about setting up Microsoft's Azure Trusted Signing service?

Question 4

What is a significant operational challenge that Rick Strahl highlights about setting up Microsoft's Azure Trusted Signing service?

Mandatory hardware dongles that are expensive and hard to obtain. Complex dependency management and confusing Azure nomenclature, requiring multiple tools and a steep learning curve. The absence of any documentation or online resources to guide users through the process. Incompatibility with most development environments and operating systems, limiting its usability.

Question 5: What is the main functional difference between the validation of TLS web server certificates and code signing certificates, as explained in the episode?

Question 5

What is the main functional difference between the validation of TLS web server certificates and code signing certificates, as explained in the episode?

TLS certificates do not expire, but code signing certificates require annual renewal for each executable. TLS certificates only verify encryption capability, code signing certificates guarantee malware-free software. TLS certificates are validated in real time at each connection, while code signing certificates only need to be valid at the time the code was originally signed. Code signing certificates require continuous online verification, whereas TLS certificates are self-contained and offline verifiable.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.