Code signing certificate expired

CI prints SignTool Error: No certificates were found that met all the given criteria or Gatekeeper says the app is damaged—code signing certificate expired means the private key still signs bytes, but PKIX clients refuse the signature because notAfter on the codesigning EKU cert is in the past.

Authenticode on Windows and Apple code signatures embed publisher identity. Operating systems and SmartScreen evaluate signing cert validity at verification time, not only when the binary was produced (unless a valid RFC 3161 timestamp was applied).

Security teams track TLS on download.example.com while the actual setup.exe on that host was signed with an expired corporate codesigning cert. Users see “Unknown publisher” even over valid HTTPS.

First response

Identify platform (Authenticode, SignTool, codesign, jarsigner), cert store location (HSM, DigiCert KeyLocker, macOS login keychain), and whether builds timestamped. Pull cert dates without rebuilding:

Get-PfxCertificate -FilePath .\codesign.pfx | Select-Object Subject, NotAfter, Thumbprint


openssl pkcs12 -in codesign.pfx -nodes -passin pass:SECRET 2>/dev/null | openssl x509 -noout -dates -subject -ext extendedKeyUsage

Confirm codeSigning EKU. Capture one failing artifact’s signature status:

Get-AuthenticodeSignature .\setup.exe | Format-List Status, SignerCertificate

What this error means

Code signing certificates are short-lived X.509 credentials distinct from TLS web certs. When expired, new signatures fail at signing time; old binaries without timestamps fail at install time on modern OS builds.

Timestamping binds signature validity to a TSA’s clock, extending trust beyond signing cert expiry for already released files. Pipelines that skip /tr or Apple’s timestamp still strand shipping teams when the cert lapses mid-quarter.

EV codesigning may add hardware token steps—renewal lead time is longer than a Let's Encrypt web cert. Plan purchases before code signing certificate expired blocks release trains.

Mobile MDM and enterprise app stores re-verify publisher signatures on every install and update. Expired signing material can block silent updates while users still launch an already-installed build, masking scope until new hires fail first install.

Kernel drivers, browser extensions, and notarized macOS bundles add notarization and stapling gates that still depend on a valid signing chain at submission time. Security teams may fix the desktop installer while auxiliary artifacts in the same release train remain unsigned or timestamp-only on an expired publisher.

Java jarsigner and NuGet signing use parallel trust models. A renewed Windows Authenticode cert does not automatically fix Android APK signing or Gradle keystore expiry—map every artifact class in the release checklist.

Common causes

Vendor renewed the cert but CI secret still mounts last year’s PFX thumbprint in Azure DevOps or GitHub Actions. macOS codesign uses Apple Distribution conflated with Developer ID Application; wrong cert type renewed on schedule but pipeline queries the expired ID.

YubiKey or cloud HSM slot still holds old cert; new cert issued to same subject never imported to build agents. Java jarsigner points at a keystore alias whose notAfter passed while TLS keystore on the same JVM was renewed.

Build agents pinned to a single thumbprint in pipeline YAML survive cert rollover until the first release after CA reissue, then every parallel job fails identically—on-call interprets this as platform outage rather than credential drift.

Forked open-source dependencies that ship nested signed DLLs inherit parent product reputation. Re-signing top-level EXE without bundled redistributables leaves SmartScreen warnings on paths users never open until support escalates.

Cross-platform monorepos that share one vault secret name for TLS and codesigning rotation alerts fix HTTPS while signing jobs still export yesterday's PFX from an older vault version path.

Confirm from the outside

Windows signature verify

Get-AuthenticodeSignature .\dist\app.exe | Select-Object Status, StatusMessage, SignerCertificate

Status HashMismatch or NotTrusted with signer NotAfter in the past confirms expiry-related failure.

macOS codesign

codesign -dv --verbose=4 /Applications/MyApp.app 2>&1 | grep -Ei 'Authority|TeamIdentifier|expir'
spctl -a -vv /Applications/MyApp.app 2>&1

OpenSSL on the signing cert (exported public half)

openssl x509 -in codesign.crt -noout -dates -subject -ext extendedKeyUsage

How to read the output

notAfter in the past blocks new signatures. Timestamped releases may still verify if TSA countersignature chains to a valid TSA cert—if the timestamp authority’s own signer expired as well, both layers fail.

Export the full certificate chain your build uses and inspect each notAfter. Intermediate CA expiry on the codesigning path fails verification on Windows with messages that resemble unknown publisher rather than explicit date text.

Repeat on shipping artifacts, not only on disk cert

Verify the binary users download, not only the renewed .crt on the build agent. CDN caching can serve an old signed installer over fresh HTTPS for hours after signing jobs succeed.

Fix checklist

1. Order or reissue codesigning cert from CA; complete EV validation if applicable.
2. Import into HSM/keychain; update CI secrets and service connections with new thumbprint.
3. Re-sign shipping binaries, installers, kernel drivers, and ClickOnce manifests.
4. Enable RFC 3161 timestamp (signtool /tr http://timestamp.digicert.com) or Apple timestamp server on every release build.
5. Validate on clean VM/mac without dev keychain trust (SmartScreen, Gatekeeper).
6. Revoke compromised old cert per CA policy; publish internal advisory if fake updates possible.
7. Add cert NotAfter to release calendar 60+ days ahead.
8. Archive Get-AuthenticodeSignature before/after in the change ticket.

Block release branches until re-sign completes for every redistributable in the installer bundle, including legacy MSI transforms and offline delta packages.

Rotate CI secrets atomically: half-updated thumbprints on matrix builds produce mixed signatures in the same semver tag. Use a maintenance window or feature flag to pause publishing while agents converge.

For Apple notarization, submit a test build and confirm stapling before mass re-sign. Notarization failures from expired intermediate chain material waste hours if caught only on production DMG.

Document hardware token custody when EV renewal requires in-person CA verification—procurement lead time often exceeds web cert automation by weeks.

When to use automation

HTTPS monitoring on your download site does not detect code signing certificate expired on the artifact itself. Track signing cert expiry in the secrets manager that feeds CI, with the same 30/14/7/1-day discipline as production TLS.

Use /check for the delivery hostnames users fetch from. Combine with internal inventory of PFX thumbprints so web and codesign expiries do not share a single spreadsheet row.