<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=windows-1252">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 11/09/2015 23:26, Michael Heide
wrote:
</div>
<blockquote class=" cite"
id="mid_20150911232604_51bf0dd1_tbb_phenom"
cite="mid:20150911232604.51bf0dd1@tbb-phenom" type="cite">
<pre wrap="">Various intermediate certs. Verisign, Symantec, etc.
But now I see, did't got it before: the root is always "Thawte Timestamping CA" -- using md5WithRSAEncryption.
Example:
<a class="moz-txt-link-freetext" href="https://www.virustotal.com/en/file/1d1bb76575e780123814259eb2dbbf26f1c9035d8f0d4bab682703823b06323f/analysis/">https://www.virustotal.com/en/file/1d1bb76575e780123814259eb2dbbf26f1c9035d8f0d4bab682703823b06323f/analysis/</a></pre>
</blockquote>
<tt>Where can I see the actual file (Not the virustotal <br>
description of the signature), I would need to look <br>
at the actual details to make sense of this.<br>
<br>
By the way, whomever signed this seems to be mixing <br>
competing CAs (GlobalSign for the cert, Symantec for <br>
the timestamp).<br>
<br>
And this file is very new (July 2015), are you sure <br>
it uses the nonstandard EncryptedDigest calculation?</tt><br>
<br>
<pre class="moz-signature" cols="72">Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. <a class="moz-txt-link-freetext" href="http://www.wisemo.com">http://www.wisemo.com</a>
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded </pre>
</body>
</html>