Can't timestamp my self-signed authenticode certificate

[CaptainFrosty]

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest released version
• Search the existing issues.
• Refer to the FAQ.
• Refer to Differences between Windows PowerShell 5.1 and PowerShell.

Steps to reproduce

Attempt Set-AuthenticodeSignature -FilePath D:\Documents\PowerShell\Microsoft.Powershell_profile.ps1 -Certificate $cert -HashAlgorithm "SHA256" -TimestampServer "http://timestamp.verisign.com/scripts/timstamp.dll"

The file shows no timestamp on the signature no matter which timestamp server I try.

Expected behavior

A Timestamp

Actual behavior

A successful signing with no timestamp.

Error details

N/A

Environment data

PSVersion                      7.4.0-preview.3
PSEdition                      Core
GitCommitId                    7.4.0-preview.3
OS                             Microsoft Windows 10.0.22621
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

I also tried on the system PowerShell.

Visuals

No response

[PaulHigin]

For some reason the code is masking the ERROR_INTERNET_NAME_NOT_RESOLVED error returned if the timestamp server url could not be resolved. So the server may be invalid and the user would never know. Apparently this was to prevent a breaking change, but it seems like the user should at least be informed via a warning message.

// CryptUIWizDigitalSign introduced a breaking change in Win8 to return this
// error code (ERROR_INTERNET_NAME_NOT_RESOLVED) when you provide an invalid
// timestamp server. It used to be 0x80070001.
// Also masking this out so that we don't introduce a breaking change ourselves.

PowerShell/src/System.Management.Automation/security/Authenticode.cs

Line 222 in ea68edc

// CryptUIWizDigitalSign introduced a breaking change in Win8 to return this

[CaptainFrosty]

@PaulHigin Thanks for the response. I figured the lack of error was something like that; it does silently complete as if everything worked, and I doubt it is the syntax as that usually gets caught right away.

I was stumped after trying several servers, but I may end up feeling dumb. I just remembered about my ESET Internet Security that I keep on a "policy mode" which means it force filters all SSL/TLS connections, and some connections do not like this friendly man in the middle. Hopefully it will just be a matter of setting ESET to exclude the certificate for the timestamp server URL to resolve it. As I will go find out now.

[CaptainFrosty]

Finally got my timestamp using http://timestamp.sectigo.com. For some reason http://timestamp.verisign.com/scripts/timstamp.dll would not function even after setting ESET to trust its certificate. In my attempts to maximize my security, I sometimes forget about my aggressive firewall, and I suppose the secure connections are upset that my security software is violating their security to maintain my security. Mildly amusing. The great majority of TLS connections are not affected though. I would like to know what in particular is doing it, perhaps some kind of MitM detection?