Expired certificate for install of 2.2.1.1043

[Steelgate]

Hi Folks,

In order to tshoot the disabled protection of MALWAREBYTES after the Windows 10 Anniversary update, I uninstalled the current version.  When I tried to install a newly downloaded copy of the .exe I received a dialog that stated the certificate for this software is EXPIRED, as of 6/19/2016. 

Can you please confirm if the cert is truly expired, and why it is expired?  This should be updated with each major version.  I realize signing is still intact, but the cert expiration damages public confidence.

For what it is worth, after re-installing, MBAM works now on my Win10 Anniversary install.

[Steelgate]

Update, the cert is expired for the SHA1 digest, not the SHA256 digest.  Please fix.

 

Edited August 28, 2016 by Steelgate

[Steelgate]

[David H. Lipman]

There are 2 certs.  One expire April 2018.

You only need one good Publisher's certificate.

I do not see it as an issue.

[Steelgate]

by default the SHA1 expired cert is used by Windows when installing.  It should be fixed.

[AdvancedSetup]

Hello @Steelgate

Please see this page for more details about certificates:
https://search.thawte.com/support/ssl-digital-certificates/index?page=content&id=AR1119
Specifically, this section:
Is timestamped code valid after a Code Signing Certificate expires?
"Thawte Code Signing for Microsoft Authenticode (Multi-Purpose) allows you to timestamp your signed code. Timestamping ensures that code will not expire when the certificate expires because the browser validates the timestamp."

And also here:
https://msdn.microsoft.com/en-us/library/windows/desktop/bb931395(v=vs.85).aspx
Particularly:
"The countersignature method of time stamping implemented below allows for signatures to be verified even after the signing certificate has expired or been revoked. The time stamp allows the verifier to reliably know the time that the signature was affixed and thereby trust the signature if it was valid at that time. The time stamper should have a reliable and protected time source."

We do have a new certificate that will be included in our next Malwarebytes Anti-Malware program release. The date of that release is yet to be determined.

Thank you