Ignore the expiration of certificate in SHA2 check

The purpose of this check is not to validate the chain, completely. The chain is needed so we know which certificate is the root and intermediates so we know which to validate and which not to validate. It is possible to have a valid authenticode signature if the certificate is expired but was timestamped while it was valid. In this case we still want to successfully build a chain to perform validation.

The expirely rules will be covered in the VerifyTrust check.

Author: vcsjones

AuthenticodeLint/Rules/SigningCertificateDigestAlgorithmRule.cs

@@ -23,6 +23,7 @@ public RuleResult Validate(Graph<Signature> graph, SignatureLoggerBase verboseWr
                 {
                     chain.ChainPolicy.ExtraStore.AddRange(certificates);
                     chain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
+                    chain.ChainPolicy.VerificationFlags = X509VerificationFlags.IgnoreNotTimeValid;
                     bool success = chain.Build(signature.SignerInfo.Certificate);
                     if (!success)
                     {