Why Time Stamps for Code Signing Certificates Matters

Why timestamping matters

If you haven't timestamped the signature while using code signing certificate for your software the signature will remain valid till the certificate is not expired. In other words, the signature remains valid, if the data has not tampered, none of the certificate is revoked in the chain, the root certificate is trusted, and the signing certificate is within the validity period. And, once the certificate expires, revoked or becomes invalid, the signature will be considered as invalid and trust warning will be displayed.

To eliminate such issues, timestamping is used. Timestamping in Code Signing Certificates helps in showing when the software file was signed. It's quite similar to signing your document in the presence of a notary. Here, Timestamping works as a notary witness to the identification of the signatory as well as the signing time.