Authenticode sign of executable with timestamping via SSL

Question

When using signtool.exe to perform authenticode signing of executables, we want to use timestamping to ensure that the executable will still be valid in the future. It seems that the timestamping server protocol only supports http:// and not https:// out of the box. This seems like a security vulnerability on Microsoft's part.

Does anyone know how to perform signtool.exe timestamping via SSL? In other words, to use a time server https://timestamp.digicert.com instead of http://timestamp.digicert.com

Answer 1

There are timestamping services available through HTTPS, see for example this Gist listing public servers:

https://gist.github.com/Manouchehri/fd754e402d98430243455713efada710

Some of them are served through HTTPS:

https://rfc3161.ai.moda
https://rfc3161.ai.moda/adobe
https://rfc3161.ai.moda/microsoft
https://rfc3161.ai.moda/apple
https://rfc3161.ai.moda/any
https://freetsa.org
https://ca.signfiles.com/tsa/get.aspx
https://tsp.iaik.tugraz.at/tsp/TspRequest

The others may also work, just try replacing http:// with https://

https://timestamp.sectigo.com