App Control: Blocks Due To CertValidationError[0x00000005]

[#1]

Environment

• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions

Symptoms

• Publisher is set to Approved in the Console.
• Block Events generated similar to:

  File 'C:\Program Files (x86)\ACME Accounting\critical.dll' [A2951...09E08] was blocked because it was unapproved. 
  Publisher[ACME Digital Inc. (IneligibleForApproval: ChainIdx[1] CertId[756] CertValidationError[0x00000005])]

Cause

The Agent relies upon the Windows Cryptographic API to validate all certificate/publisher information. This message (CertValidationError[0x00000005]) is returned as a combination of the CERT_TRUST_STATUS errors Windows encountered:

• CERT_TRUST_IS_NOT_TIME_VALID 0x00000001
• CERT_TRUST_IS_REVOKED 0x00000004

Resolution

A different Approval Method (Custom Rule, Global Approval, etc) must be used in these circumstances, as the Agent will not allow Publisher Approvals for a certificate that has been revoked.

Related Content

CERT_TRUST_STATUS (wincrypt.h) - Win32 apps
App Control: CERT_TRUST_IS_NOT_TIME_VALID causing blocks for signed files