Code signing issue -- corrupt or invalid file

[Bob Hartzell]

I just learned that there is an issue when downloading .exe files using IE that are code signed with a SHA-1 certificate which is the current situation for the koolsoftware products as explained here

---------------------

"Microsoft has published a security advisory on "Deprecation of SHA-1 Hashing Algorithm for Microsoft Root Certificate Program". The new policy takes effect after January 1, 2016 and requires CAs to migrate to the stronger SHA-2 hashing algorithm.

In summary, Windows will cease accepting SHA-1 certificates on January 1, 2017. To continue to work with Microsoft platforms, all SHA-1 SSL certificates issued before or after this announcement must be replaced with a SHA-256 (SHA-2) equivalent by January 1, 2017. Organizations need to develop a migration plan for any SHA-1 end-entity SSL certificates that expire after January 1, 2017 and SHA-1 code signing certificates that expire after January 1, 2016. SHA1 code signing certificates that are time stamped before 1 January 2016 will be accepted until such time when Microsoft decides SHA1 is vulnerable to pre-image attack. Microsoft will give new consideration to the SHA deprecation deadlines in July 2015.

1. Customers should "renew" with SHA-2 end-entity and intermediate certificates.

2. Microsoft will cease trusting Code Signing Certificates using SHA-1 on January 1, 2016.

Most applications, servers and browsers now support SHA-2, however some older operating systems such as Windows XP prior to Service Pack 3, and some mobile devices do not."

-------------

I will be upgrading to a SHA-2 certificate shortly. Using a different browser other than IE or downloading a zip by-passes the issue. If you are having trouble, email us.

[Bob Hartzell]

The problem should be solved now. All downloads have been resigned with a SHA256 certificate.