Driver signing certificates expired

[gybe]

I am trying to silently deploy VirtualBox 4.3.6 using SCCM but the installation of the VBoxUSB.inf driver is failing due to the driver certificate having expired on 7 Feb 2014.

Does anyone know of any plans to repackage v4.3.6 with an updated certificate?

[moe]

I too have got this problem. Looking forward to hear how to deal with the issue.
edit: The problem exists also in the 4.3.8 version.

[klaus]

Can you provide any proof that the installation failed due to an expired certificate? What error message do you get? Just the "not WHQL certified" one? That's normal, our drivers are not WHQL certified, but they definitely are all signed with a valid certificate.

Because the way we sign things (using trusted timestamps) the expiration of the certificate should be no problem, as there is proof the signature was created while it was valid. So the screenshot of the certificate is completely meaningless in this context.

The claim that 4.3.8 is affected makes this even more implausible, because that package was signed with a newer certificate which is valid for a long time.

[moe]

To get my hands into certificate file I've used this guide: http://www.catonrug.net/2013/03/virtual ... icate.html. The certificate I get from file_VBoxGuestAdditions.iso's extraction is valid to 8th of Feb 2014 here.
Obviously the guide is for past version of the VirtualBox but I'm not familiar with a newer guide for silent installation of VirtualBox. If the silent installation instructions have been changed since, could you please direct me to correct direction?

[klaus]

The silent installation instructions are in the manual (we prefer not to refer to usually outdated external sites), but you're right, there was an old certificate file included inside the 4.3.8 guest additions. Either way, you can extract the necessary new certificate from the .exe file, too. Right click on the executable, select "Properties", "Digital Signatures" tab, select the signature, click on "Details", click on "View Certificate", "Details" tab, click on "Copy to File...". This will give you the up to date certificate. I'm sure there is a command line tool to extract the certificate, too, but the above is the "quick" one-off solution. Don't ask me why Microsoft decided to make the signatures such an endless pain...

[moe]

Thanks klaus. With your instructions I got the valid certificate and the silent installer ran successfully.

[klaus]

The included file will be fixed once 4.3.10 is out. Thanks for pointing out this issue, it slipped through as we have this fixed for months with the development version, and that meant the certificate was already present when testing 4.3.8... cert handling is complicated.