title: How to Code Sign with multiple timestamps - my stamps get overwritten
body: <h2>Problem</h2>
  
  <p>Though I am getting no error on verbose SignTool (<a href="https://docs.microsoft.com/en-us/dotnet/framework/tools/signtool-exe" rel="nofollow noreferrer">manual</a>) commands on my windows executable, the timestamps get overwritten, and I wish there to be multiple timestamps, is that possible?</p>
  
  <ul>
  <li>If it <strong><em>is</em></strong> possible, then how?</li>
  <li>If it <strong><em>is not</em></strong> possible, and I have to use only 1 single timestamp, then which server would you recommend in the long run? (<a href="https://www.digicert.com/code-signing/signcode-signtool-command-line.htm" rel="nofollow noreferrer">DigiCert</a> is coming to my mind now.)</li>
  </ul>
  
  <hr>
  
  <h2>Here's what I tried</h2>
  
  <p>PowerShell function</p>
  
  
  
  <pre class="lang-powershell prettyprint-override"><code>function sign32exe([string]$arg)
  {
      &amp; 'C:\Program Files (x86)\Windows Kits\10\bin\x86\signtool.exe' sign /fd sha256 /a $arg
      Start-Sleep -Seconds 5
      &amp; 'C:\Program Files (x86)\Windows Kits\10\bin\x86\signtool.exe' timestamp /tr http://timestamp.globalsign.com/?signature=sha2 /td sha256 /v $arg
      Start-Sleep -Seconds 5
      &amp; 'C:\Program Files (x86)\Windows Kits\10\bin\x86\signtool.exe' timestamp /tr http://sha256timestamp.ws.symantec.com/sha256/timestamp /td sha256 /v $arg
      Start-Sleep -Seconds 5
      &amp; 'C:\Program Files (x86)\Windows Kits\10\bin\x86\signtool.exe' timestamp /tr http://time.certum.pl /td sha256 /v $arg
  }
  </code></pre>
  
  <hr>
  
  <h2>PowerShell output</h2>
  
  <p>I get positive output from SignTool, but the timestamps get overwritten by each invocation (restructured for better readability):</p>
  
  
  
  <p>The signing process goes well:</p>
  
  <pre class="lang-none prettyprint-override"><code>Done Adding Additional Store
  Successfully signed: .\my.exe
  </code></pre>
  
  <p>Followed by the timestamping, which individually go without a problem:</p>
  
  <pre class="lang-none prettyprint-override"><code>Successfully timestamped: .\my.exe
  Number of files successfully timestamped: 1
  Number of errors: 0
  
  Successfully timestamped: .\my.exe
  Number of files successfully timestamped: 1
  Number of errors: 0
  
  Successfully timestamped: .\my.exe
  Number of files successfully timestamped: 1
  Number of errors: 0
  </code></pre>
  
  <hr>
  
  <h2>Image for the words</h2>
  
  <p><a href="https://i.stack.imgur.com/wPsSj.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/wPsSj.png" alt="only the last timestamp present"></a></p>
  
  <hr>
  
  <h2>Rationale</h2>
  
  <p>The certificate I own is from Certum authority, called <a href="https://www.certum.eu/en/cert_offer_en_standard_code_signing/" rel="nofollow noreferrer">Standard Code Signing</a>. Since it expires soon, I'd like to ensure my windows executable does not get into trouble after my signing certificate expiration. I thought more timestamps would be better in case one server becomes unavailable in time or the service stops, an example of this could be that Certum authority would disappear for instance.</p>
  
  <hr>
  
  <h2>Additional detail</h2>
  
  <p>My ideal solution should solve the above problem:</p>
  
  <ul>
  <li><p>by timestamping with more than one server; or</p></li>
  <li><p>by quoting some credible source on that it is not possible</p></li>
  </ul>