App Control: Publisher Approval of Microsoft Files Fails Due to CERT_TRUST_IS_NOT_SIGNATURE_VALID

[#1]

Environment

• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions

Symptoms

• Microsoft is an approved publisher, but newly created files are not getting approved.
• Block Events similar to:

  Execution block (unapproved file) File 'test.exe' [...] was blocked because it was unapproved.
  Publisher[Microsoft Corporation (IneligibleForApproval: CounterChainIdx[1] CertId[499] 
  ValidationError[01000048:CERT_TRUST_IS_NOT_SIGNATURE_VALID:CERT_TRUST_REVOCATION_STATUS_UNKNOWN:CERT_TRUST_IS_OFFLINE_REVOCATION])]

Cause

• The issue is with the countersignature certificate chain and this is indicated with this portion of the Block Event:

  IneligibleForApproval: CounterChainIdx[1]

• The full validation error returned by Windows Crypto API:

  ValidationError[01000048:CERT_TRUST_IS_NOT_SIGNATURE_VALID:CERT_TRUST_REVOCATION_STATUS_UNKNOWN:CERT_TRUST_IS_OFFLINE_REVOCATION])]

• The Publisher Approval will fail due to the CERT_TRUST_IS_NOT_SIGNATURE_VALID portion.
• CERT_TRUST_IS_NOT_SIGNATURE_VALID happens when there is an older version of the Intermediate Certificate "Microsoft Time-Stamp PCA 2010" in the endpoint's local certificate store, and the new version of the cert is not present or it cannot be downloaded due to network restrictions.
• A Block Event will be enforced, even if Ignore Counter Chain Errors feature is enabled. This is due to the additional, CERT_TRUST_IS_NOT_SIGNATURE_VALID error.

Resolution

As this is a failure on the endpoint, options for remediation via the App Control Console alone is limited. It may be possible to prevent this by either:

• Flushing the CryptnetUrlCache as outlined in this article. This could potentially be deployed via a script or one time GPO.
• Verifying that the correct version of the Intermediate Certificate "Microsoft Time-Stamp PCA 2010" is present on each endpoint prior file creation per this KB.
• Approving the countersignature certificate "Microsoft Time-Stamp Service" in the web console will resolve the blocks per this KB.

Additional Notes

• The App Control agent has no control of the Certificate Validation Errors returned by Windows Crypto API, for more information how those errors are generated please check this KB.
• Microsoft has a known issue with its counter signature Intermediate certificate "Microsoft Time-Stamp PCA 2010", please contact them for details.

Related Content

Event ID 4107 or ID 11 is logged - Windows Server
Re: SCCM Inventory Process causing execution blocks?
App Control: How to Approve Certificates Having Counter Chain Signature Errors