| Previous | Next |
| STATUS_DYNAMIC_CODE_BLOCKED | STATUS_STRICT_CFG_VIOLATION |
STATUS_IMAGE_CERT_EXPIRED
The image signer certificate is expired
Certificate validity is bounded by NotBefore and NotAfter values. An image signed after the certificate expired, or verified without an acceptable trusted timestamp, can fail even when the signature bytes are mathematically correct. A valid timestamp may allow policy to evaluate the signature at the signing time, but timestamp trust and algorithm policy must also succeed.
Changing the local clock is not a repair and can disrupt other security checks. The correct response is to inspect the timestamp chain and obtain a currently acceptable signed build when the original signature cannot be validated at an allowed time.
What to inspect
- Capture certificate validity dates, signature time, timestamp countersignature, and both certificate chains.
- Verify system time and time source before comparing the failure across machines.
- Use SignTool or WinVerifyTrust to distinguish an expired signer from an invalid or absent timestamp.
- Request a re-signed release when policy no longer accepts the original certificate or digest algorithm.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: WinVerifyTrust
- Microsoft: SignTool
- IETF RFC 5280: certificate and CRL profile
Looking for a different code? Search another status or error code.