[Mike B]

I went ahead and clicked on update to the latest testing version in Windows 11 Pro (current updates). Went ahead and downloaded and appeared to install, then stopped just before the end with a certificate error - not in cert store. Installer provided info showing both were for James Ross and most info was the same, but the existing one was "not verified" and the new was was "verified" from a different authority. Seems to have worked after I clicked to accept the new one. Any comments?

[engmod]

I just updated to 5.5 1937 with no error.

Is your system time correct?

[Mike B]

 engmod, on 07 May 2024 - 10:16 PM, said:

I just updated to 5.5 1937 with no error.

Is your system time correct?

System time is correct.

The version that OR wants to update to (link in the upper right of the menu window) is T1.5.1-957-g4fd63a327. The error I get (in both Windows 11 computers) is System.IO.InvalidDataException: Cryptographic certificates do not match. Followed by the certificate information which differs in provider and "verified" status. Again, it may be a non-issue, one-time, etc. because when acknowledged it goes ahead and completes the update. Just a concern due to all the security issues happening these days.

Note: I was unable to copy the text in the message window. Even a screenshot didn't work. If I click on "Yes" it goes ahead and completes the update; it appears just before the end of the process.

Maybe this should be in "was it a bug?" Sorry for starting in the wrong place if so. Or else, maybe I'll download the latest regular version and uninstall/reinstall then switch back to testing.

Can't test it in Windows 10 - only remaining computers with it are not capable of running OR.

EDIT: aha! Found the screenshot! Attaching...

[Peter B.]

Hi Mike,

I just checked the downloads in my archive, and it looks as if the certificate James used for signing his downloads and executable files has expired on Apri 23rd. Instead of getting a renewed certificate from his old provider Sectigo he chose to get a new one on April 22nd from another provider, GoGetSSL. So, if you're updating from a version compiled before that date to a newer version, you get this message under Windows 11. It may be also related to the fact that you're using Windows 11 Professional. In contrast to the Home version Windows Professional can enforce several stricter security settings by so-called Group Policies, and this warning message could be triggered by such a policy.

The official download of version 1.5.1 was also signed with the older Sectigo certificate. So, anyone updating from 1.5.1 on a computer with a similar configuration as you have may run into this message as well.

BTW, I just checked Carlo Santucci's OR_NewYear_MG downloads, and these are not signed at all. This might be the reason why several users experience warnings or blocked downloads from their antivirus software when downloading from Carlo's site.

Regards, Peter

[James Ross]

Mike B, on 07 May 2024 - 08:34 PM, said:

I went ahead and clicked on update to the latest testing version in Windows 11 Pro (current updates). Went ahead and downloaded and appeared to install, then stopped just before the end with a certificate error - not in cert store. Installer provided info showing both were for James Ross and most info was the same, but the existing one was "not verified" and the new was was "verified" from a different authority. Seems to have worked after I clicked to accept the new one. Any comments?

Peter has basically explained this, but I'll go into some more specifics.

The code signing certificates expire after (a maximum of) 3 years, so they necessarily change periodically. Their presence allows you to trust that the program came from me (and my computer) without any tampering. For security, the built-in updater checks the newly downloaded version has an appropriate certificate to match the current version, so that you cannot be given a fake update.

The updater check is supposed to allow for the minor changes each certificate renewal or replacement has - in this case, you can see I've moved house (from London to Ilford) and the authority which issues the certificate has changed. It checks that the subject name (CN=), country (C=), and validity are the same, and everything else can change.

What's gone wrong in this case is that it is reporting the old certificate as invalid, which is both right and wrong. (This is probably a bug in our code.) The certificate has expired but the Open Rails code is not just signed, but timestamped, which is a cryptographic way of proving the time of signing. This allows for expired certificates (but not revoked ones!) to be still considered valid so long as they were used within their validity period.

If you look at the properties of an old Open Rails program, the certificates will still show as valid in Windows for this reason, but it looks like we aren't correctly accounting for the timestamping in the way we check the certificate validity.

This update is safe to apply as the subject is correct. :)

[Mike B]

Thanks all. That explains it. Suspected it was something like that. BTW, I have OR installed in both a desktop (better graphics) and laptop (it works...) with Win11 Pro in the desktop and Home in the laptop. Same message appeared in both when updating. Windows itself didn't complain, which I found odd because it seems to discover security errors in California when a butterfly hiccups in the Bahamas. :curiousPC: