When applying a digital signature certificate to a build, how can I use a timestamp url that requires credentials?

[VictorClaessen]

Hi,

I've just received a code signing certificate. I can build and sign executables with this certificate (in LabVIEW 2018) when I use http://timestamp.digicert.com as a timestamp URL in the build settings.

However, I would like to know if I can use the timestamp URL from the authority that gave out this code signing certificate. This authority is called HARICA, and their timestamp URL is http://ts.harica.gr. However, this server requires (http basic) authorization.

I have tried to enter http://user:pass@ts.harcia.gr in the Timestamp URL in the LabVIEW build settings, but that does not work.

Does anyone have any clever suggestions?

Best regards,

Vic

[thols]

In what way does it not work? Error message?

Could it be because of CA/Browser Forum’s Code Signing Baseline Requirements introduced stricter private key protections effective June 1, 2023? 

If so, upvote this idea: Support code signing certificates with cloud keys when building applications and installers

[VictorClaessen]

I get the error below. I believe it's because the http request is denied because of missing authentication. (I do not have control over this server, so I cannot check the logs. However, when I open the URL in Firefox, the browser asks for http basic authentication. I am able to successfully login in Firefox.)

Click the link below to visit the Application Builder support page. Use the following information as a reference:

Error 15 occurred at CodeSignAPI.lvlib:Get Signing Error String.vi

Possible reason(s):

Error: The Timestamp Authority URL specified does not point to a valid Timestamp Authority server, or an unknown error occurred.


Complete call chain:
CodeSignAPI.lvlib:Get Signing Error String.vi
CodeSignAPI.lvlib:Sign with Certificate.vi
AB_Application.lvclass:PostBuild.vi
AB_Engine_Build.vi
AB_Build_Invoke.vi
AB_Build_Invoke.vi.ProxyCaller

[VictorClaessen]

I am now aware that there seem to be two timestamp protocols, the "authenticode" one, and RFC 3161. HARICA seems to use RFC 3161, and LabVIEW 2018 works with authenticode. I believe it is using MS signtool.exe in the background.

It looks like signtool.exe can also support RFC 3161.

Does anyone know if newer versions of LabVIEW use signtool.exe in the newer RFC 3161 mode?

[VictorClaessen]

Ah, with "API monitor" I now see a call to SignerTimeStampEx, which indeed does Authenticode timestamping. "to perform X.509 Public Key Infrastructure (RFC 3161) time stamping, use the SignerTimeStampEx2 function." Hmm...there's probably no way to convince LabVIEW to do that?