Windows 10: How does Windows 10 know if an application is from a verified publisher digital certificate...

I have a VM and it has Windows 10 LTSC fresh install always offline without any updates, so last update is late 2018. I downloaded an application and checked inside the Windows 10 VM and somehow Windows knows it has a digital certificate timestamped from 2020 to 2024? how does it know since its offline and never been updated? also does this mean that the .exe i downloaded is 100% safe and not tampered with since it has a verified publisher status in windows?

:)

 

what are the necessary digital certificates for windows 10 ?

Hi , does anyone know what are the necessary (real necessity) digital certificates in the Root CA and Intermediate CA for windows 10 ? i have a new windows 10 machine, and there is a full list of digital certificates inside. Most of them are not intuitive
(it just says "for application" ) -> i would like to remove, most, if not all of them in the RCA and ICA list.

if any Microsoft support is reading this , is there a detailed write-up and documentation , on what each cert does, and why is it necessary ?

 

Unknown Publisher when trying the installer(exe/msi) on windows 10

I'm using Visual Studio 2019 and have build "Installers(msi/exe)" using "Setup Wizard".

When i'm running the set.exe installer, the application "publisher" is being reported as "Unknown".

I've gone through some references and found that the setup.exe needs to be digitally signed with the certificate. So,

i have followed below steps to add digital signature to the setup.exe

1. Create Digital certificate (https://knowledge.digicert.com/solution/SO26065.html)

2. Using signtool i have digitally signed setup.exe

signtool.exe sign /f "E:\sample.pfx" /p "sample@123" /tr
Time Stamp Server & Stamping Protocols | Sectigo® Official /v "E:\setup.exeWhen
i try to run setup.exe locally, the application "publisher" is reported as "localhost" instead of "Unknown", but if i

run the same setup.exe on another system application "publisher" is reported as "Unknown"Please provide any suggestions on fixing this "Unknown
Publisher" issue

 

Can't run program with 'unknown publisher'

A little background might help.

Before you run a program, it's very important to be sure that the program is actually what it claims to be. For example: Just because a file
calls itself Winword.exe, how do you know it really is Microsoft Word?

Software developers vouch for their identity by obtaining a digital certificate, which is a proof of identity not unlike a passport or a driver's license. Digital certificates are issued by trustworthy organizations called certificate authorities.

Most people wouldn't begin to know (and why should they) how to check whether a program they want to run has a valid digital certificate, so the operating system does that for you by consulting the list of known and accepted certificate authorities included
in the operating system.

So here's what happened: Windows won't open your program because the certificate authority (the 'publisher') is not, or is no longer, on the list of known and accepted certificate authorities. The publisher might have been known and accepted in an earlier
list of certificate authorities, but the lists are updated frequently. The April 2018 update, or another update, revised the list of known publishers, and the publisher for your program ain't no longer on it.

None of this was invented by Microsoft, who is simply complying with internationally accepted standards for safe computing.

You're seeing the message because Windows can no longer guarantee that the program is safe to use.