title: Reading multiple signatures from executable file
body: <p>I am trying to write code that reads signatures (certificates) from DLLs or and EXEs. Most DLLs or EXEs have only one signature, and my code reads all certificates associated with this signature correctly. More specifically it reads signing cert, it's issuer (not root), countersigning cert (with timestamp) and its issuer (not root). I have 2 sample programs in C++ and C#, they both return the same certs. This is C# code, C++ is 100 times longer :)</p>
  
  <pre><code>static void Main(string[] args)
  {
      X509Certificate2Collection collection = new X509Certificate2Collection();
      collection.Import(args[0]);
  }
  </code></pre>
  
  <p>But there are DLLs that have 2 signatures, as shown in file properties / Digital Signatures, for example C:\Program Files (x86)\Microsoft SQL Server\80\Tools\Binn\msvcr71.dll:</p>
  
  <p><img src="https://i.stack.imgur.com/eSsoM.jpg" alt="File properties and digital signatures for msvcr71.dll"></p>
  
  <p>For this DLL my code reads only certificates associated with first signature. </p>
  
  <p>I also tried to use signtool, and it returns the same info as my code: first cert (with it's path), and countersignature (with its path). But also note error at the end.</p>
  
  <pre><code>C:\Windows&gt;signtool verify /d /v "C:\Program Files (x86)\Microsoft SQL Server\80\Tools\Binn\msvcr71.dll"
  
  Verifying: C:\Program Files (x86)\Microsoft SQL Server\80\Tools\Binn\msvcr71.dll
  Signature Index: 0 (Primary Signature)
  Hash of file (sha1): 33BBCCF6326276B413A1ECED1BF7842A6D1DDA07
  
  Signing Certificate Chain:
  Issued to: Microsoft Root Certificate Authority
  Issued by: Microsoft Root Certificate Authority
  Expires:   Sun May 09 19:28:13 2021
  SHA1 hash: CDD4EEAE6000AC7F40C3802C171E30148030C072
  
      Issued to: Microsoft Code Signing PCA
      Issued by: Microsoft Root Certificate Authority
      Expires:   Wed Jan 25 19:32:32 2017
      SHA1 hash: FDD1314ED3268A95E198603BA8316FA63CBCD82D
  
          Issued to: Microsoft Corporation
          Issued by: Microsoft Code Signing PCA
          Expires:   Fri Feb 01 18:49:17 2013
          SHA1 hash: 8849D1C0F147A3C8327B4038783AEC3E06C76F5B
  
  The signature is timestamped: Sat Feb 11 14:03:12 2012
  Timestamp Verified by:
  Issued to: Microsoft Root Certificate Authority
  Issued by: Microsoft Root Certificate Authority
  Expires:   Sun May 09 19:28:13 2021
  SHA1 hash: CDD4EEAE6000AC7F40C3802C171E30148030C072
  
      Issued to: Microsoft Time-Stamp PCA
      Issued by: Microsoft Root Certificate Authority
      Expires:   Sat Apr 03 09:03:09 2021
      SHA1 hash: 375FCB825C3DC3752A02E34EB70993B4997191EF
  
          Issued to: Microsoft Time-Stamp Service
          Issued by: Microsoft Time-Stamp PCA
          Expires:   Thu Oct 25 16:42:17 2012
          SHA1 hash: FC33104FAE31FB538749D5F2D17FA0ECB819EAE5
  
  SignTool Error: The signing certificate is not valid for the requested usage.
      This error sometimes means that you are using the wrong verification
      policy. Consider using the /pa option.
  
  Number of files successfully Verified: 0
  Number of warnings: 0
  Number of errors: 1
  </code></pre>
  
  <p>I have 2 questions: 
  - what is the purpose of second signature
  - how to read it (so far only windows explorer file property dialog can show it).</p>
  
  <p>Thank you!</p>