App Control: CERT_TRUST_IS_NOT_TIME_VALID causing blocks for signed files

[#1]

Environment

• App Control Agent: All Supported Versions
• App Control Console: All Supported Versions

Symptoms

The Agent is enforcing Execution Blocks due to CERT_TRUST_IS_NOT_TIME_VALID or Time Validity with messages similar to:

File 'c:\program files (x86)\some vendor\file.dll' [a85a...f0dc] was blocked because it was unapproved. 
Publisher[Some Vendor, LLC (IneligibleForApproval: ChainIdx[0] CertId[29] Time Validity 
ValidFrom[11/13/2019 9:40:35 PM] ValidTo[2/11/2021 9:40:35 PM] SignatureTime[10/20/2023 3:00:32 AM])]

 

Cause

The vendor signed the file while using a certificate that had already expired. This can be confirmed by comparing the ValidTo and SignatureTime details in the Description of the Block Event:

ValidFrom[11/13/2019 9:40:35 PM] ValidTo[2/11/2021 9:40:35 PM] SignatureTime[10/20/2023 3:00:32 AM])]

Resolution

This is a type of Validation Failure that will prevent Publisher Approvals from working for this file. An alternative Approval Method (Global Approval, Local Approval, Custom Rule, etc) will be required to allow the execution until the vendor is able to provide an updated file that has been signed correctly.

Additional Notes

• Expired certificates are allowed by default; however, the file must be signed during the Validation Time Frame of the certificate used. If not, this could be an invalid/falsely signed file.
• Certificate details can also be viewed/confirmed with the PowerShell command:

  Get-AuthenticodeSignature -FilePath "C:\Path\To\File.dll" | Format-List

Related Content

CERT_TRUST_STATUS (wincrypt.h) - Win32 apps
App Control: How To Use Windows CAPI2 Logs To Verify Partial Chain Errors
App Control: Will the Agent Approve Files Signed With an Expired Certificate?