11 Comodo Bugs & Digital Signature Fixes
This list covers 11 common Comodo digital signature issues and the bugs that cause them, with practical fixes for each. It’s for developers, IT admins, and anyone who signs code or documents with Comodo certificates and has hit an error like “The digital signature of the object did not verify.”
1. “The digital signature of the object did not verify”
This is the most frequent Comodo signing bug. It usually appears when the signing certificate or its chain is not installed on the verifying machine, or when the timestamp server response is missing. Fix: install the full certificate chain (including the root and intermediate) on the target system, and always add a timestamp when signing. If the error persists, check that the system clock is correct—a skewed clock breaks signature validation.
2. Certificate Chain Not Included in Signed File
Comodo certificates are issued with an intermediate CA (like “COMODO RSA Code Signing CA”). If you sign without embedding the chain, Windows and browsers can’t build a path to the root, causing warnings. Use SignTool with the /ac flag to attach the intermediate certificate file (.crt) during signing. Alternatively, use /tr and /td for RFC 3161 timestamping that also embeds the chain.
3. Timestamp Server Unreachable or Slow
Comodo’s legacy timestamp server (http://timestamp.comodoca.com) is often slow or blocks certain regions. This causes the signing tool to hang or fail. Switch to the more reliable RFC 3161 server: http://timestamp.sectigo.com (Comodo’s rebranded service). Always use /tr with /td SHA256 in SignTool to get a proper timestamp that survives certificate expiry.
4. SHA-1 Hash Algorithm Rejected
Comodo stopped issuing SHA-1 certificates in 2016, and many older signing scripts still default to SHA-1. Windows 10 and 11 block SHA-1 signatures as insecure. Fix: explicitly specify SHA-256 in your signing command. For SignTool, add /fd SHA256 and /td SHA256. If you’re using a third-party tool, look for a “hash algorithm” dropdown and select SHA-256.
5. Private Key Not Found or Not Accessible
This bug occurs when the certificate is installed but the private key is missing or the user lacks permission. Comodo code signing certificates often come as a .pfx with a password; if the password is wrong or the key is on a hardware token, SignTool reports “No certificates were found that met all the given criteria.” Reinstall the .pfx using the correct password, or use the token’s management tool to verify the key is present and accessible.
6. Invalid or Expired Certificate After Signing
Even if you sign correctly, the signature becomes invalid once the certificate expires—unless you used a timestamp. This is a common misunderstanding. A timestamp from a reliable server (like Comodo’s) proves the signature existed before expiry. Without it, the signature is treated as expired. Always timestamp your signatures; it’s the single most important habit.
7. “The digital signature is invalid” on 64-bit vs 32-bit
Some older Comodo signing tools or scripts sign only the 32-bit version of a file, but the 64-bit version remains unsigned. This causes Windows to show “Unknown publisher” on one architecture. Fix: sign each binary separately—both .exe and .dll files, for both architectures. Use a wildcard in your build script to sign all PE files, not just the main executable.
8. Cross-Certificate Issues with Windows
Comodo’s root certificate may not be in the Windows trusted root store on older systems. This leads to “The certificate chain was processed, but terminated in a root certificate which is not trusted.” Fix: install the latest root update from Microsoft, or manually add Comodo’s root certificate (AddTrust External CA Root) to the Trusted Root store. For enterprise deployment, push this via Group Policy.
9. SmartScreen Reputation Not Built
Comodo signing doesn’t instantly give you SmartScreen reputation. New certificates and low-volume publishers still trigger “Windows protected your PC.” This isn’t a bug but a common complaint. Over time, as more users run your signed software, reputation improves. To speed up, submit your signed files to Microsoft’s SmartScreen submission portal. Also ensure your certificate is an EV code signing certificate—those get immediate reputation.
10. Signing with the Wrong Certificate
If you have multiple Comodo certificates installed, SignTool might pick the wrong one (e.g., an expired or email certificate). This produces a signature that doesn’t match your publisher name. Fix: use the /sha1 option to specify the exact certificate thumbprint. Find the thumbprint in the certificate’s details tab, then use it in your signing command.
11. File Corruption After Signing
Rarely, signing a large file with Comodo’s old tools corrupts the file, making it unopenable. This was more common with the old COMODO SignTool versions. Fix: use the latest Microsoft SignTool (from Windows SDK) instead of third-party wrappers. Always verify the signed file with signtool verify /pa to confirm integrity. If corruption occurs, re-sign from the original unsigned file.
How to Choose
When picking a solution, first identify the exact error message and the environment (Windows version, signing tool, certificate type). For most issues, the fix is to switch to SHA-256 and a reliable timestamp server. If you’re a developer, integrate signing into your build with SignTool and automate chain embedding. For enterprise deployments, ensure root certificates are distributed. If you’re still stuck, use the Windows Event Viewer to get the exact error code, then search for that code with “Comodo”—that will point to the specific bug.
Frequently Asked Questions
Q: Why does my Comodo signature work on my machine but not on others?
A: The verifying machine lacks the intermediate or root certificate. Embed the full chain in the signed file or distribute the certificates via Group Policy.
Q: Can I use a free timestamp server with Comodo?
A: Yes, but use a reliable one like http://timestamp.sectigo.com (RFC 3161). Free servers may be slow or unreliable, but they work.
Q: What is the difference between /t and /tr in SignTool?
A: /t uses the older Authenticode timestamp protocol, /tr uses RFC 3161. RFC 3161 is more secure and recommended, especially with SHA-256.
Q: My Comodo certificate is expired. Can I still sign?
A: No, you cannot sign with an expired certificate. You need to renew it. However, previously signed files with a timestamp remain valid.
Q: How do I fix “The hash is not signed” error?
A: This means the file’s hash was not included in the signature. Re-sign with /fd SHA256 to force the hash algorithm.
Q: Does Comodo signing work on macOS or Linux?
A: Comodo code signing is primarily for Windows. For macOS, you need an Apple Developer ID certificate. For Linux, use GPG or a similar tool.
Final Thoughts
Most Comodo digital signature bugs stem from outdated signing practices—SHA-1, missing chains, or no timestamp. By updating your signing commands to include SHA-256, the full chain, and a reliable timestamp server, you can resolve the majority of issues. Always test your signed files on a clean Windows VM to ensure they verify correctly. If a problem persists, check the exact error code and consult Comodo’s knowledge base—they have detailed articles for each error.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.