Could not verify that LibreWolf-WinUpdater.exe was correctly signed

ltguillaume commented

2026-04-29 12:02:19 +00:00

(Migrated from codeberg.org)

Description

OSSign has changed their certificate name from Cloudyne Systems (Scheibling Consulting AB) to OSSign (Scheibling Consulting AB) since the previous release of LibreWolf and WinUpdater (see Reddit).
WinUpdater checks for the right name before continuing and warns you if it has changed (see screenshot below).

As such, only if you're still running WinUpdater 1.14.0 - 1.14.3, you may have to click "Yes" once if you see the following (i.e. when WinUpdater is trying to update itself):

After that, everything will continue as normal.

All in all, one might say WinUpdater "failed successfully": the certificate check did its job as supposed to, only the valid certificate unexpectedly had its name changed 😅

## Description - [OSSign](https://librewolf.net/docs/faq/#who-is-ossign-scheibling-consulting-ab) has changed their certificate name from `Cloudyne Systems (Scheibling Consulting AB)` to `OSSign (Scheibling Consulting AB)` since the previous release of LibreWolf and WinUpdater (see [Reddit](https://reddit.com/r/LibreWolf/comments/1syuvpi/getting_this_error_while_updating_librewolf/oixhc95/?context=3#oixhc95)). - WinUpdater checks for the right name before continuing and warns you if it has changed (see screenshot below). As such, only if you're still running WinUpdater **1.14.0 - 1.14.3**, you may have to **click "Yes" once** if you see the following (i.e. when WinUpdater is trying to update **itself**): ![image](/attachments/563c278d-42a8-4fbe-8407-3da960d67a86) After that, everything will continue as normal. All in all, one might say WinUpdater "failed successfully": the certificate check did its job as supposed to, only the _valid_ certificate unexpectedly had its name changed 😅

retry-the-user commented

2026-04-29 16:27:11 +00:00

(Migrated from codeberg.org)

I didn't see this warning, so manually installed a new LibreWolf via installer. Now I have a whole new error problem with WinUpdater. I'll post a new issue about it.

theofaron commented

2026-04-30 07:12:58 +00:00

(Migrated from codeberg.org)

I can confirm this behavior. It appears to be due to new rules for Windows PowerShell.

Invoke-WebRequest -Uri “https://ct.de” -TimeoutSec 30

Security warning: Risk during script execution
Invoke-WebRequest parses the content of the web page. Script code on the web page may be executed while the page is being parsed.
      RECOMMENDED ACTION:
      Use the -UseBasicParsing switch to prevent script code from running.

      Do you want to continue?

[Y] Yes  [A] Yes, all  [N] No  [K] No, none  [H] Pause  [?] Help (default is “N”): A

Hangs indefinitely.

Invoke-WebRequest -Uri “https://ct.de” -TimeoutSec 30 -UseBasicParsing


StatusCode        : 200
StatusDescription : OK
Content           : <!DOCTYPE html>
                    <html lang="de" data-consentmanagement=“true”><head><link href="//heise.cloudimg.io"
                    rel="dns-prefetch"/><link href="//heise.cloudimg.io" rel="preconnect"/><link
                    href="//data-fb7
[...]

Works perfectly, and PowerShell remembers the previous answer “A”.

Edit:
I tried it again for a bit, and the error message pops up pretty quickly, so that’s probably not the issue.
If you give me the PowerShell command, I’ll give it a try.

I can confirm this behavior. It appears to be due to new rules for Windows PowerShell. ``` Invoke-WebRequest -Uri “https://ct.de” -TimeoutSec 30 Security warning: Risk during script execution Invoke-WebRequest parses the content of the web page. Script code on the web page may be executed while the page is being parsed. RECOMMENDED ACTION: Use the -UseBasicParsing switch to prevent script code from running. Do you want to continue? [Y] Yes [A] Yes, all [N] No [K] No, none [H] Pause [?] Help (default is “N”): A ``` Hangs indefinitely. ``` Invoke-WebRequest -Uri “https://ct.de” -TimeoutSec 30 -UseBasicParsing StatusCode : 200 StatusDescription : OK Content : <!DOCTYPE html> <html lang="de" data-consentmanagement=“true”><head><link href="//heise.cloudimg.io" rel="dns-prefetch"/><link href="//heise.cloudimg.io" rel="preconnect"/><link href="//data-fb7 [...] ``` Works perfectly, and PowerShell remembers the previous answer “A”. Edit: I tried it again for a bit, and the error message pops up pretty quickly, so that’s probably not the issue. If you give me the PowerShell command, I’ll give it a try.

steelowheel commented

2026-04-30 07:17:16 +00:00

(Migrated from codeberg.org)

I clicked "no" and Librewolf portable still updated (from 1.14.3 to ~~1.50.0-1~~ 150.0-1) and launched. I guess everything's fine?

Edit: typo

I clicked "no" and Librewolf portable still updated (from 1.14.3 to ~~1.50.0-1~~ 150.0-1) and launched. I guess everything's fine? **Edit:** typo

theofaron commented

2026-04-30 08:01:01 +00:00

(Migrated from codeberg.org)

Get-AuthenticodeSignature "C:\Portable\librewolf\LibreWolf-WinUpdater.exe"

SignerCertificate      : [Subject]
                           CN=OSSign (Scheibling Consulting AB), O=OSSign (Scheibling Consulting AB), L=Uppsala, C=SE

                         [Issuer]
                           CN=Microsoft ID Verified CS AOC CA 04, O=Microsoft Corporation, C=US

                         [Serial Number]
                           33000097B27A86ABE3D7EC83850000000097B2

                         [Not Before]
                           29.04.2026 13:09:36

                         [Not After]
                           02.05.2026 13:09:36

                         [Thumbprint]
                           45E117A9C8085FCFCAC0DC038A7E866640F00B5E

TimeStamperCertificate : [Subject]
                           CN=Microsoft Public RSA Time Stamping Authority, OU=nShield TSS ESN:7A1A-05E0-D947,
                         OU=Microsoft Ireland Operations Limited, O=Microsoft Corporation, L=Redmond, S=Washington,
                         C=US

                         [Issuer]
                           CN=Microsoft Public RSA Timestamping CA 2020, O=Microsoft Corporation, C=US

                         [Serial Number]
                           330000005B4AB58D41326DDC7400000000005B

                         [Not Before]
                           08.01.2026 19:59:05

                         [Not After]
                           07.01.2027 19:59:05

                         [Thumbprint]
                           DAACDA1851DE00EE1916479CD19663E18BA2C24F

Status                 : Valid
StatusMessage          : Signatur wurde überprüft.
Path                   : C:\Portable\librewolf\LibreWolf-WinUpdater.exe
SignatureType          : Authenticode
IsOSBinary             : False

Get-AuthenticodeSignature "C:\Portable\librewolf\LibreWolf-Portable.exe"

SignerCertificate      : [Subject]
                           CN=Cloudyne Systems (Scheibling Consulting AB), O=Cloudyne Systems (Scheibling Consulting 
                         AB), L=Uppsala, C=SE
                         
                         [Issuer]
                           CN=Microsoft ID Verified CS EOC CA 02, O=Microsoft Corporation, C=US
                         
                         [Serial Number]
                           3300078494210AD9096DE90CA6000000078494
                         
                         [Not Before]
                           20.03.2026 21:19:38
                         
                         [Not After]
                           23.03.2026 21:19:38
                         
                         [Thumbprint]
                           421C8223B984238D48E167346AE28433524399E9
                         
TimeStamperCertificate : [Subject]
                           CN=Microsoft Public RSA Time Stamping Authority, OU=nShield TSS ESN:451A-05E0-D947, 
                         OU=Microsoft Ireland Operations Limited, O=Microsoft Corporation, L=Redmond, S=Washington, 
                         C=US
                         
                         [Issuer]
                           CN=Microsoft Public RSA Timestamping CA 2020, O=Microsoft Corporation, C=US
                         
                         [Serial Number]
                           330000005C614C00A6A7F2E92300000000005C
                         
                         [Not Before]
                           08.01.2026 19:59:06
                         
                         [Not After]
                           07.01.2027 19:59:06
                         
                         [Thumbprint]
                           BC84E98DED90495D724D25AB9FEF671FB719D061
                         
Status                 : Valid
StatusMessage          : Signatur wurde überprüft.
Path                   : C:\Portable\librewolf\LibreWolf-Portable.exe
SignatureType          : Authenticode
IsOSBinary             : False

Both actually look fine, so why the error?

I downloaded the latest version of LibreWolf. Same error. I decided to answer “Yes.” I think LibreWolf-WinUpdater.exe updated itself and reported that there was no new version (LibreWolf.exe) available.

It seems you have to answer “Yes” at least once. Scary, but… Now it works. Waiting for the next update.

Thank you very much for your work.

Edit:
Maybe the reason.
LibreWolf-WinUpdater.exe
BEFORE update

                         [Not Before]
                           20.03.2026 21:19:38
                         
                         [Not After]
                           23.03.2026 21:19:38

After update

                         [Not Before]
                           29.04.2026 13:09:36

                         [Not After]
                           02.05.2026 13:09:36

Get-AuthenticodeSignature "C:\Portable\librewolf\LibreWolf-WinUpdater.exe" ``` SignerCertificate : [Subject] CN=OSSign (Scheibling Consulting AB), O=OSSign (Scheibling Consulting AB), L=Uppsala, C=SE [Issuer] CN=Microsoft ID Verified CS AOC CA 04, O=Microsoft Corporation, C=US [Serial Number] 33000097B27A86ABE3D7EC83850000000097B2 [Not Before] 29.04.2026 13:09:36 [Not After] 02.05.2026 13:09:36 [Thumbprint] 45E117A9C8085FCFCAC0DC038A7E866640F00B5E TimeStamperCertificate : [Subject] CN=Microsoft Public RSA Time Stamping Authority, OU=nShield TSS ESN:7A1A-05E0-D947, OU=Microsoft Ireland Operations Limited, O=Microsoft Corporation, L=Redmond, S=Washington, C=US [Issuer] CN=Microsoft Public RSA Timestamping CA 2020, O=Microsoft Corporation, C=US [Serial Number] 330000005B4AB58D41326DDC7400000000005B [Not Before] 08.01.2026 19:59:05 [Not After] 07.01.2027 19:59:05 [Thumbprint] DAACDA1851DE00EE1916479CD19663E18BA2C24F Status : Valid StatusMessage : Signatur wurde überprüft. Path : C:\Portable\librewolf\LibreWolf-WinUpdater.exe SignatureType : Authenticode IsOSBinary : False ``` Get-AuthenticodeSignature "C:\Portable\librewolf\LibreWolf-Portable.exe" ``` SignerCertificate : [Subject] CN=Cloudyne Systems (Scheibling Consulting AB), O=Cloudyne Systems (Scheibling Consulting AB), L=Uppsala, C=SE [Issuer] CN=Microsoft ID Verified CS EOC CA 02, O=Microsoft Corporation, C=US [Serial Number] 3300078494210AD9096DE90CA6000000078494 [Not Before] 20.03.2026 21:19:38 [Not After] 23.03.2026 21:19:38 [Thumbprint] 421C8223B984238D48E167346AE28433524399E9 TimeStamperCertificate : [Subject] CN=Microsoft Public RSA Time Stamping Authority, OU=nShield TSS ESN:451A-05E0-D947, OU=Microsoft Ireland Operations Limited, O=Microsoft Corporation, L=Redmond, S=Washington, C=US [Issuer] CN=Microsoft Public RSA Timestamping CA 2020, O=Microsoft Corporation, C=US [Serial Number] 330000005C614C00A6A7F2E92300000000005C [Not Before] 08.01.2026 19:59:06 [Not After] 07.01.2027 19:59:06 [Thumbprint] BC84E98DED90495D724D25AB9FEF671FB719D061 Status : Valid StatusMessage : Signatur wurde überprüft. Path : C:\Portable\librewolf\LibreWolf-Portable.exe SignatureType : Authenticode IsOSBinary : False ``` Both actually look fine, so why the error? I downloaded the latest version of LibreWolf. Same error. I decided to answer “Yes.” I think LibreWolf-WinUpdater.exe updated itself and reported that there was no new version (LibreWolf.exe) available. It seems you have to answer “Yes” at least once. Scary, but… Now it works. Waiting for the next update. Thank you very much for your work. Edit: Maybe the reason. LibreWolf-WinUpdater.exe BEFORE update ``` [Not Before] 20.03.2026 21:19:38 [Not After] 23.03.2026 21:19:38 ``` After update ``` [Not Before] 29.04.2026 13:09:36 [Not After] 02.05.2026 13:09:36 ```

ltguillaume commented

2026-04-30 10:19:51 +00:00

(Migrated from codeberg.org)

@theofaron wrote in https://codeberg.org/librewolf/winupdater/issues/71#issuecomment-14037152:

I can confirm this behavior. It appears to be due to new rules for Windows PowerShell.

What behavior are you confirming exactly? What do you see in the WinUpdater window at that time and what interactions did you do with it?

Invoke-WebRequest -Uri “https://ct.de” -TimeoutSec 30

Security warning: Risk during script execution
Invoke-WebRequest parses the content of the web page. Script code on the web page may be executed while the page is being parsed.
      RECOMMENDED ACTION:
      Use the -UseBasicParsing switch to prevent script code from running.

      Do you want to continue?

[Y] Yes  [A] Yes, all  [N] No  [K] No, none  [H] Pause  [?] Help (default is “N”): A

Hangs indefinitely.

WinUpdater doesn't use Invoke-WebRequest.

Invoke-WebRequest -Uri “https://ct.de” -TimeoutSec 30 -UseBasicParsing


StatusCode        : 200
StatusDescription : OK
Content           : <!DOCTYPE html>
                    <html lang="de" data-consentmanagement=“true”><head><link href="//heise.cloudimg.io"
                    rel="dns-prefetch"/><link href="//heise.cloudimg.io" rel="preconnect"/><link
                    href="//data-fb7
[...]
Works perfectly, and PowerShell remembers the previous answer “A”.

Edit: I tried it again for a bit, and the error message pops up pretty quickly, so that’s probably not the issue. If you give me the PowerShell command, I’ll give it a try.

It's more likely you've just had bad luck with Codeberg when WinUpdater seemed stuck: Codeberg's servers are known to be quite unresponsive at times lately, so when WinUpdater tries to check for/download an update, it seems like it's stuck, then eventually times out with an error.

Both [certificates] actually look fine, so why the error?

Yes, both certificates can be trusted. The error message is shown because the certificate name (or "subject" in PowerShell) had changed unexpectedly. WinUpdater checks the name as well, because otherwise you can't be sure it hasn't been tampered with, then signed using a different certificate.

I downloaded the latest version of LibreWolf. Same error. I decided to answer “Yes.” I think LibreWolf-WinUpdater.exe updated itself and reported that there was no new version (LibreWolf.exe) available.

This seems fine. The latest LibreWolf setup file contains the version of WinUpdater which was still checking for the old certificate name, so you'd be seeing the warning until you click "Yes" one time to allow WinUpdater to update itself.

It seems you have to answer “Yes” at least once. Scary, but… Now it works. Waiting for the next update.

I agree, this has not been a great experience. Hopefully, many users reach out or at least try to inform themselves about what's going on, that's good to see 🙂

Thank you very much for your work.

Thank you for reporting and trying to figure things out, much appreciated!

Edit:
Maybe the reason.
LibreWolf-WinUpdater.exe
BEFORE update
...
After update
...

Nope, this was all due to the name change. The Not before and Not after specifies that you cannot use that certificate to sign anything before / after those dates. So when we sign LibreWolf/WinUpdater/Portable, we get a new certificate to sign with almost every time, because it is only valid to sign with for a span of 3 days. That's what's OSSign has chosen and doesn't come into play when verifying the signature.

@theofaron wrote in https://codeberg.org/librewolf/winupdater/issues/71#issuecomment-14037152: > I can confirm this behavior. It appears to be due to new rules for Windows PowerShell. What behavior are you confirming exactly? What do you see in the WinUpdater window at that time and what interactions did you do with it? > ```text > Invoke-WebRequest -Uri “https://ct.de” -TimeoutSec 30 > > Security warning: Risk during script execution > Invoke-WebRequest parses the content of the web page. Script code on the web page may be executed while the page is being parsed. > RECOMMENDED ACTION: > Use the -UseBasicParsing switch to prevent script code from running. > > Do you want to continue? > > [Y] Yes [A] Yes, all [N] No [K] No, none [H] Pause [?] Help (default is “N”): A > ``` > > Hangs indefinitely. WinUpdater doesn't use `Invoke-WebRequest`. > ```text > Invoke-WebRequest -Uri “https://ct.de” -TimeoutSec 30 -UseBasicParsing > > > StatusCode : 200 > StatusDescription : OK > Content : <!DOCTYPE html> > <html lang="de" data-consentmanagement=“true”><head><link href="//heise.cloudimg.io" > rel="dns-prefetch"/><link href="//heise.cloudimg.io" rel="preconnect"/><link > href="//data-fb7 > [...] > ``` > > Works perfectly, and PowerShell remembers the previous answer “A”. > > Edit: I tried it again for a bit, and the error message pops up pretty quickly, so that’s probably not the issue. If you give me the PowerShell command, I’ll give it a try. It's more likely you've just had bad luck with Codeberg when WinUpdater seemed stuck: Codeberg's servers are known to be quite unresponsive at times lately, so when WinUpdater tries to check for/download an update, it _seems_ like it's stuck, then eventually times out with an error. >Both [certificates] actually look fine, so why the error? Yes, both certificates can be trusted. The error message is shown because the certificate name (or "subject" in PowerShell) had changed unexpectedly. WinUpdater checks the name as well, because otherwise you can't be sure it hasn't been tampered with, then signed using a different certificate. >I downloaded the latest version of LibreWolf. Same error. I decided to answer “Yes.” I think LibreWolf-WinUpdater.exe updated itself and reported that there was no new version (LibreWolf.exe) available. This seems fine. The latest LibreWolf setup file contains the version of WinUpdater which was still checking for the old certificate name, so you'd be seeing the warning until you click "Yes" one time to allow WinUpdater to update itself. > It seems you have to answer “Yes” at least once. Scary, but… Now it works. Waiting for the next update. I agree, this has not been a great experience. Hopefully, many users reach out or at least try to inform themselves about what's going on, that's good to see 🙂 > Thank you very much for your work. Thank you for reporting and trying to figure things out, much appreciated! >Edit: >Maybe the reason. >LibreWolf-WinUpdater.exe >BEFORE update >... >After update >... Nope, this was all due to the name change. The `Not before` and `Not after` specifies that you cannot use that certificate _to sign_ anything before / after those dates. So when we sign LibreWolf/WinUpdater/Portable, we get a new certificate to sign with almost every time, because it is only valid to sign with for a span of 3 days. That's what's OSSign has chosen and doesn't come into play when _verifying_ the signature.

ltguillaume commented

2026-04-30 10:24:02 +00:00

(Migrated from codeberg.org)

@steelowheel wrote in https://codeberg.org/librewolf/winupdater/issues/71#issuecomment-14037329:

I clicked "no" and Librewolf portable still updated (from 1.14.3 to 1.50.0-1) and launched. I guess everything's fine?

1.14.3 is the previous version number for WinUpdater, while 150.0-1 (not 1.50.0-1), which is the the previous version number of LibreWolf itself. I think you still need to update in your case, so close LibreWolf, run LibreWolf-WinUpdater.exe and click "Yes" once, then let it update itself (WinUpdater) to 1.14.5 (you'll see it in the title bar) and then LibreWolf to 150.0.1-1.

@steelowheel wrote in https://codeberg.org/librewolf/winupdater/issues/71#issuecomment-14037329: > I clicked "no" and Librewolf portable still updated (from 1.14.3 to 1.50.0-1) and launched. I guess everything's fine? `1.14.3` is the previous version number for WinUpdater, while `150.0-1` (not `1.50.0-1`), which is the the previous version number of LibreWolf itself. I think you still need to update in your case, so close LibreWolf, run `LibreWolf-WinUpdater.exe` and click "Yes" once, then let it update itself (WinUpdater) to `1.14.5` (you'll see it in the title bar) and then LibreWolf to `150.0.1-1`.

steelowheel commented

2026-04-30 13:44:27 +00:00

(Migrated from codeberg.org)

@ltguillaume wrote in https://codeberg.org/librewolf/winupdater/issues/71#issuecomment-14082512:

@steelowheel wrote in #71 (comment):

I clicked "no" and Librewolf portable still updated (from 1.14.3 to 1.50.0-1) and launched. I guess everything's fine?

1.14.3 is the previous version number for WinUpdater, while 150.0-1 (not 1.50.0-1), which is the the previous version number of LibreWolf itself. I think you still need to update in your case, so close LibreWolf, run LibreWolf-WinUpdater.exe and click "Yes" once, then let it update itself (WinUpdater) to 1.14.5 (you'll see it in the title bar) and then LibreWolf to 150.0.1-1.

Yes, you're right, I ran LibreWolf-WinUpdater.exe again, clicked "Yes" and now Librewolf version is at 150.0.1-1. Thanks!

@ltguillaume wrote in https://codeberg.org/librewolf/winupdater/issues/71#issuecomment-14082512: > @steelowheel wrote in #71 (comment): > > > I clicked "no" and Librewolf portable still updated (from 1.14.3 to 1.50.0-1) and launched. I guess everything's fine? > > `1.14.3` is the previous version number for WinUpdater, while `150.0-1` (not `1.50.0-1`), which is the the previous version number of LibreWolf itself. I think you still need to update in your case, so close LibreWolf, run `LibreWolf-WinUpdater.exe` and click "Yes" once, then let it update itself (WinUpdater) to `1.14.5` (you'll see it in the title bar) and then LibreWolf to `150.0.1-1`. Yes, you're right, I ran LibreWolf-WinUpdater.exe again, clicked "Yes" and now Librewolf version is at 150.0.1-1. Thanks!

Rows
Columns

Could not verify that LibreWolf-WinUpdater.exe was correctly signed #71

Description