Signing with a RFC 3161 Timestamp Server

Title

Summary

Discussion on specifying a RFC 3161 URL and workaround when digitally signing with InstallShield.

Symptoms

When using Signtool, the /tr command line parameter allowed users to specify the URL of the RFC 3161 time stamp server. There is no direct method or workaround in InstallShield 2015 to specify the URL of a RFC 3161 time stamp server.

Cause

In older versions of InstallShield, the following entry ?<DigitalSignature Timestamp="http://timestamp.verisign.com/scripts/timstamp.dll"/> in the settings.xml could be modified to <DigitalSignature Timestamp="http://timestamp.geotrust.com/tsa"/> to utilize this feature. Due to the changes in signing in InstallShield 2015, this workaround prevents the installation from being signed correctly.

Steps To Reproduce

Create a new Basic MSI project
Go to Media -> Release
Create a new Product Configuration
Create a new Release
Select signing tab, specify a valid certificate
Build and run setup, setup is signed with timestamp correctly
Close InstallShield
Open an Administrative Notepad.exe
File -> Open? to InstallShield\2015\Support\0409 and specify Settings.xml
Change the line of <DigitalSignature Timestamp="http://timestamp.verisign.com/scripts/timstamp.dll"/> to <DigitalSignature Timestamp="http://timestamp.geotrust.com/tsa"/> to try and workaround the issue
Save the file
Open InstallShield and build the project
A -7346 warning occurs that it was signed with a SHA-1 certificate and the resulting file does not have a valid timestamp

Resolution

This issue was originally submitted to our Engineering team and was tracked under issue #IOJ-1732554. The issue has been resolved in InstallShield 2016, please see the InstallShield 2016 release notes in the Related Documents section below for additional information.

Workaround

At this time, it is suggested to sign manually using signtool.exe post build to specify the /tr command line.

Related Documents

Signtool.exe (Sign Tool) - MSDN Article
InstallShield 2016 Release Notes - InstallShield 2016 Release Notes

Was this helpful?

Support Hub

Product

InstallShield

Visibility

Guest

URL Name

signing-with-a-rfc-3161-timestamp-server

Are you sure you want to cancel the case creation?

Case closed successfully

Action performed successfully

Upload Attachment

Maximum file size allowed is 3 MB.

File type not supported.

Supported file types:

Documents (.txt, .doc, .docx, .pdf), Images (.jpg, .png), Comma Separated Files (.csv) Speadsheets (.xlsx, .xls)

Are you sure you want to close this case

Get Hotline support

Products	Region	Phone Numbers
FlexNet Operations FlexNet Embedded FlexNet Publisher FlexNet Connect FlexNet Code Insight InstallAnywhere InstallShield	North America *	+1 630-332-2513 (toll) +1 877-279-2853 (toll-free in North America)
	Europe *	+44 1925 944367 (toll) +44 800 047 8642 (toll-free in Europe)
	Japan *	+81 3-4540-5335 (select option 2)
	Australia *	+61 3 9895 2177 +61 1800 560 603 (toll-free in Australia)
Usage Intelligence (formerly Revulytics) Compliance Intelligence	Please use the Case Portal to submit your support ticket or reach out to your Revenera contact.

Revenera Assistant