DLP agent on windows : Digital code signing certificate expiration impact on installers

Products

• Data Loss Prevention Enterprise Suite

Issue/Introduction

Due to mandatory compliance requirement required all installed software must be signed by valid digital certificate. Hence, the 3rd party  software restriction policy has stopping them from installing the agent due to the expired cert. 

This is the snippet of the agent installation log 

SOFTWARE RESTRICTION POLICY: Verifying package --> 'AgentInstall-x64_<version>.msi' against software restriction policy

SOFTWARE RESTRICTION POLICY: AgentInstall-x64_<version>.msi has a digital signature

MSI SOFTWARE RESTRICTION POLICY: SaferIdentifyLevel reported failure.  Assuming untrusted. . . (GetLastError returned 87)
MSI (s) AgentInstall-x64_<version>.msi is not permitted due to an error in software restriction policy processing. The object cannot be trusted.

Cause

Digital code signing certificate expiration on DLP agent installer binaries.

Resolution

In the world of digital code signing, signing time and countersigning time (commonly referred to as timestamping) are critical concepts that determine how software is trusted by operating systems.

Countersigning time solves the certificate expiry problem.

Therefore, even if a code signing certificate has expired, the installer remains valid and verifiable as long as it was properly signed and timestamped. 

For more technical details on this process, please refer to the DigiCert FAQ: https://knowledge.digicert.com/general-information/code-signing-certificate-faq

Bottom line is that, an expired certificate simply means it can no longer be used to sign new binaries; however, it remains valid for software binaries.

Use new agent versions use updated certificate as it is not possible to extend or renew the certificate for an existing package.ref-https://knowledge.broadcom.com/external/article?articleId=438422