Digital signature for Arduino drivers has expired

[padyx]

Hi all

I bought an Arduino Mega 2560 today and tried to install it on Windows 8.1 (64bit).
The installation fails when I try to run it either with the DPinst... file and also using the device manager.

After some digging, Windows logs in the event log:

Fault bucket -449683682, type 5
Event Name: PnPDriverImportError
Response: Not available
Cab Id: 0

Problem signature:
P1: x64
P2: E0000247
P3: arduino.inf
P4: faec302146978caa63d663b26e395958a030879e

Further digging in the log files transmitted by Windows Error Reporting shows that the signature does not seem to be valid:

sto:      {DRIVERSTORE IMPORT VALIDATE} 20:20:22.608
     sig:           {_VERIFY_FILE_SIGNATURE} 20:20:22.639
     sig:                Key      = arduino.inf
     sig:                FilePath = C:\WINDOWS\System32\DriverStore\Temp\{13172709-e6fc-3949-b248-451415a46a57}\arduino.inf
     sig:                Catalog  = C:\WINDOWS\System32\DriverStore\Temp\{13172709-e6fc-3949-b248-451415a46a57}\arduino.cat
!    sig:                Verifying file against specific (valid) catalog failed! (0x800b0109)
!    sig:                Error 0x800b0109: A certificate chain processed, but terminated in a root certificate which is not trusted 

by the trust provider.
     sig:           {_VERIFY_FILE_SIGNATURE exit(0x800b0109)} 20:20:22.688
     sig:           {_VERIFY_FILE_SIGNATURE} 20:20:22.689
     sig:                Key      = arduino.inf
     sig:                FilePath = C:\WINDOWS\System32\DriverStore\Temp\{13172709-e6fc-3949-b248-451415a46a57}\arduino.inf
     sig:                Catalog  = C:\WINDOWS\System32\DriverStore\Temp\{13172709-e6fc-3949-b248-451415a46a57}\arduino.cat
!    sig:                Verifying file against specific Authenticode(tm) catalog failed! (0x800b0101)
!    sig:                Error 0x800b0101: A required certificate is not within its validity period when verifying against the 

current system clock or the timestamp in the signed file.
     sig:           {_VERIFY_FILE_SIGNATURE exit(0x800b0101)} 20:20:22.701
!!!  sig:           An unexpected error occurred while validating driver package. Catalog = arduino.cat, Error = 0x800B0101
!!!  sig:           Driver package is considered unsigned, and Code Integrity is enforced.
!!!  sig:           Driver package failed signature validation. Error = 0xE0000247
     sto:      {DRIVERSTORE IMPORT VALIDATE: exit(0xe0000247)} 20:20:22.707
!!!  sig:      Driver package failed signature verification. Error = 0xE0000247
!!!  sto:      Failed to import driver package into Driver Store. Error = 0xE0000247
     sto: {Stage Driver Package: exit(0xe0000247)} 20:20:22.710
<<<  Section end 2013/12/21 20:20:22.722

Finally, checking the "Digital signatures" tab in the Windows Explorer shows for arduino.cat:

The driver installation fails with a message like "Could not add the driver to the store"...

Could you have a look at this?
I'll preserve a copy of the logfiles for a short time, should you need them.

[cmaglie]

It seems that the signature expires together with the certificate used to sign the driver.
This means that if the certificate released by the certification authority expires, for example, in two years then driver signed with the certificate has the same validity (two years). Currently, a new driver should be released every time a certificate renewal is issued.

I'm looking for a way to avoid that, any suggestion welcome.

[barbudor]

Hi Christian

My company is doing Windows drivers for our own hardware and your
experience seems opposite to what our R&D has commited : when the
certificate expires, the driver should still be valid and keep on
installing. Only new drivers could not get signed with the expired
certificate. Otherwise it should be a mess.
I will check again with them and let you know.
I'm sure that others people in the same situation here could confirm.

best regards

barbudor

2014/1/5 Cristian Maglie notifications@github.com

It seems that the signature expires together with the certificate used to
sign the driver.
This means that if the certificate released by the certification authority
expires, for example, in two years then driver signed with the certificate
has the same validity (two years). Currently, a new driver should be
released every time a certificate renewal is issued.

I'm looking for a way to avoid that, any suggestion welcome.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/1755#issuecomment-31598964
.

[cmaglie]

@barbudor
I've updated the catalog "arduino.cat"

https://github.com/arduino/Arduino/tree/ide-1.5.x/build/windows/dist/drivers

it should work now, I've used the "timestamping" feature as described here http://stackoverflow.com/a/3410212 now the signature should not expire together with the certificate.

[barbudor]

Great
I'm happy if I have been able to help with my 2c

In the meantime I checked with our R&D :We purchased our certificate from
Verisign as SHA1 but we never tested on Windows 8 because our products runs
on Windows 7 Embedded.
But they confirmed also that properly signed a driver should not expire
even if the original certificate does.

Best regards

2014/1/7 Cristian Maglie notifications@github.com

@barbudor https://github.com/barbudor
I've updated the catalog "arduino.cat"

https://github.com/arduino/Arduino/tree/ide-1.5.x/build/windows/dist/drivers

it should work now, I've used the "timestamping" feature as described here
http://stackoverflow.com/a/3410212 now the signature should not expire
together with the certificate.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/1755#issuecomment-31748139
.

[cmaglie]

I'm about to publish an updated version of the drivers, if someone wants to give it a try here the updated IDE 1.0.5:

EDIT: http://arduino.cc/en/Main/Software

C

[ticapix]

@cmaglie 👍 successfully working with an Arduino Uno board under Windows 8.1 64bits :)

[padyx]

I checked the arduino.cat file @cmaglie posted with the "Update driver" feature in the device manager and it seems to work.
Looking forward to the 1.5.5 version of the IDE too :)

[cmaglie]

Both 1.0.5-r2 and 1.5.5-r2 are published on the download page. Further tests welcome! :-)