2019 SHA-2 Code Signing Support requirement for Windows and WSUS
Applies to: Windows 7 Service Pack 1Windows Server 2008 R2 Service Pack 1Windows Server 2008 Service Pack 2 More
Summary
To protect your security, Windows operating system updates are dual-signed using both the SHA-1 and SHA-2 hash algorithms to authenticate that updates come directly from Microsoft and were not tampered with during delivery. Due to weaknesses in the SHA-1 algorithm and to align to industry standards Microsoft will only sign Windows updates using the more secure SHA-2 algorithm exclusively.
Customers running legacy OS versions (Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Server 2008 SP2) will be required to have SHA-2 code signing support installed on their devices by July 2019. Any devices without SHA-2 support will not be offered Windows updates after July 2019. To help prepare you for this change, we will release support for SHA-2 signing in 2019. Windows Server Update Services (WSUS) 3.0 SP2 will receive SHA-2 support to properly deliver SHA-2 signed updates. Refer to the Product Updates section for the migration timeline.
Background details
The Secure Hash Algorithm 1 (SHA-1) was developed as an irreversible hashing function and is widely used as a part of code-signing. Unfortunately, the security of the SHA-1 hash algorithm has become less secure over time due to weaknesses found in the algorithm, increased processor performance, and the advent of cloud computing. Stronger alternatives such as the Secure Hash Algorithm 2 (SHA-2) are now strongly preferred as they do not suffer from the same issues. For more information about of the deprecation of SHA-1, see Hash and Signature Algorithms.
Product update schedule
Starting in early 2019, the migration process to SHA-2 support will occur in stages, and support will be delivered in standalone updates. Microsoft is targeting the following schedule to offer SHA-2 support. Please note that the timeline below is subject to change. We will update this page as the process begins and as needed.
| Target Date | Event | Applies To |
| March 12, 2019 | Stand Alone security updates KB4474419 and KB4490628 released to introduce SHA-2 code sign support.
| Windows 7 SP1, Windows Server 2008 R2 SP1 |
| March 12, 2019 | Stand Alone update, KB4484071 is available on Windows Update Catalog for WSUS 3.0 SP2 that supports delivering SHA-2 signed updates. For those customers using WSUS 3.0 SP2, this update should be manually installed no later than June 18, 2019. | WSUS 3.0 SP2 |
| April 9, 2019 | Stand Alone update, KB4493730 that introduce SHA-2 code sign support for the servicing stack (SSU) was released as a security update.
| Windows Server 2008 SP2 |
| May 14, 2019 | Stand Alone security update KB4474419 released to introduce SHA-2 code sign support. | Windows Server 2008 SP2 |
| June 11, 2019 | Stand Alone security update KB4474419 re-released to add missing MSI SHA-2 code sign support. | Windows Server 2008 SP2 |
| June 18, 2019 | Windows 10 updates signatures changed from dual signed (SHA-1/SHA-2) to SHA-2 only. No customer action required. | Windows 10 1709, Windows 10 1803, Windows 10 1809, Windows Server 2019 |
| June 18, 2019 | Required: For those customers using WSUS 3.0 SP2, KB4484071 must be manually installed by this date to support SHA-2 updates. | WSUS 3.0 SP2 |
| July 9, 2019 | Required: Updates for legacy Windows versions will require that SHA-2 code signing support be installed. The support released in April and May (KB4493730 and KB4474419) will be required in order to continue to receive updates on these versions of Windows. Legacy Windows updates signatures changed from dual signed (SHA-1/SHA-2) to SHA-2 only at this time. | Windows Server 2008 SP2 |
| July 16, 2019 | Windows 10 updates signatures changed from dual signed (SHA-1/SHA-2) to SHA-2 only. No customer action required. | Windows 10 1507, |
| August 13, 2019 | Required: Updates for legacy Windows versions will require that SHA-2 code signing support be installed. The support released in March (KB4474419 and KB4490628) will be required in order to continue to receive updates on these versions of Windows. If you have a device or VM using EFI boot, please see the FAQ section for additional steps to prevent an issue in which your device may not start. Legacy Windows updates signatures changed from dual signed (SHA-1/SHA-2) to SHA-2 only at this time. | Windows 7 SP1, Windows Server 2008 R2 SP1 |
| September 10, 2019 | Legacy Windows updates signatures changed from dual signed (SHA-1/SHA-2) to SHA-2 only. No customer action required. | Windows Server 2012, Windows 8.1, Windows Server 2012 R2 |
Current status
Windows 7 SP1 and Windows Server 2008 R2 SP1
The following updates must be installed and the device must be restarted before installing any Rollup released August 13, 2019 or later. The required updates can be installed in any order and do not need to be reinstalled, unless there is a new version of the required update.
- The latest servicing stack update (SSU) (KB4490628). If you are using Windows Update, the latest SSU will be offered to you automatically.
- The latest SHA-2 update (KB4474419) released August 13, 2019. If you are using Windows Update, the latest SHA-2 update will be offered to you automatically.
- If you are using EFI Boot on your device or virtual machine (VM), you must also install KB3133977. Currently, KB3133977 is required as a workaround for a known issue when using EFI Boot and should be applied even if you are not using BitLocker. For more information on this issue, see the FAQ below.
Important You must restart your device after installing all the required updates, before installing any Monthly Rollup, Security-only update, or Preview of Monthly Rollup.
Windows Server 2008 SP2
The following updates must be installed and the device must be restarted before installing any Rollup released July 9, 2019 or later. The required updates can be installed in any order and do not need to be reinstalled, unless there is a new version of the required update.
- The latest servicing stack update (SSU) (KB4493730). If you are using Windows Update, the latest SSU will be offered to you automatically.
- The latest SHA-2 update (KB4474419) released June 11, 2019. If you are using Windows Update, the latest SHA-2 update will be offered to you automatically.
Important You must restart your device after installing all the required updates, before installing any Monthly Rollup, Security-only update, or Preview of Monthly Rollup.
Frequently Ask Questions
General information, planning and issue prevention
The SHA-2 code-signing support was shipped early to ensure that most customers would have the support well in advance of Microsoft’s change to SHA-2 signing for updates to these systems. The stand-alone updates include some additional fixes and are being made available to ensure that all of the SHA-2 updates are in a small number of easily identifiable updates. Microsoft recommends that customers that maintain system images for these OSes to apply these updates to the images.
2. Will other versions of WSUS add SHA-2 support?
Starting with WSUS 4.0 on Windows Server 2012, WSUS already supports SHA-2-signed updates, and no customer action is needed for these versions.
Only WSUS 3.0 SP2 needs KB4484071 installed to support SHA2 only signed updates.
Assume you run Windows Server 2008 SP2. If you dual-boot with Windows Server 2008 R2 SP1/Windows 7 SP1, the boot manager for this type of system is from the Windows Server 2008 R2/Windows 7 system. In order to successfully update both of these systems to use SHA-2 support, you must first update the Windows Server 2008 R2/Windows 7 system so that the boot manager is updated to the version that supports SHA-2. Then, update the Windows Server 2008 SP2 system with SHA-2 support.
Similar to the dual-boot scenario, the Windows 7 PE environment must be updated to SHA-2 support. Then, the Windows Server 2008 SP2 system must be updated to SHA-2 support.
- Run Windows setup to completion and boot into Windows prior to installing August 13, 2019 or later updates
- Open an administrator command prompt window, run bcdboot.exe. This copies the boot files from the Windows directory and sets up the boot environment. See BCDBoot Command-Line Options for more details.
- Before installing any additional updates, install the August 13, 2019 re-release of KB4474419, KB4490628 , and KB3133977 for Windows 7 SP1 and Windows Server 2008 R2 SP1.
- Restart the operating system. This restart is required
- Install any remaining updates.
- Install the image on the disk and boot into Windows.
- At the command prompt, run bcdboot.exe. This copies the boot files from the Windows directory and sets up the boot environment. See BCDBoot Command-Line Options for more details.
- Before installing any additional updates, install the August 13, 2019 re-release of KB4474419, KB4490628 , and KB3133977 for Windows 7 SP1 and Windows Server 2008 R2 SP1.
- Restart the operating system. This restart is required
- Install any remaining updates.
Note Currently, KB3133977 is required as a workaround for a known issue when using EFI Boot and should be applied even if you are not using BitLocker.
Yes, you will need to install the required updates before proceeding: SSU (KB4490628), SHA-2 update (KB4474419) and KB3133977. Also, you are required to restart your device after installing the required updates before installing any further updates. Currently, KB3133977 is required as a workaround for a known issue that may prevent your EFI boot device or virtual machine (VM) from starting up and should be applied even if you are not using BitLocker.
Windows 10, version 1903 supports SHA-2 since it's release and all updates are already SHA-2 only signed. There is no action needed for this version of Windows.
Issue recovery
If you are seeing error 0xc0000428 with the message “Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.” please follow these steps to recover.
- Start the operating system using recovery media.
- Before installing any additional updates, install KB3133977 using Deployment Image Servicing and Management (DISM) for Windows 7 SP1 and Windows Server 2008 R2 SP1.
- Reboot into the recovery media. This restart is required
- At the command prompt, run bcdboot.exe. This copies the boot files from the Windows directory and sets up the boot environment. See BCDBoot Command-Line Options for more details.
- Restart the operating system.
Note Currently, KB3133977 is required as a workaround for a known issue when using EFI Boot on x64 and should be applied even if you are not using BitLocker.
- Halt deployment to other devices and do not restart any devices or VMs that have not already restarted.
-
Identify devices and VMs in restart pending state with updates released August 13, 2019 or later and open an elevated command prompt
-
Find the package identity for the update you want to remove by using the following command using the KB number for that update (replace 4512506 with the KB number you are targeting, if it is not the Monthly rollup released August 13, 2019): dism /online /get-packages | findstr 4512506
-
Use the following command to remove the update, replacing <package identity> with what was found in the previous command: Dism.exe /online /remove-package /packagename:<package identity>
-
You will now need to install the required updates listed in the How to get this update section of the update you are trying to install, or the required updates listed above in the Current status section of this article.
Note Any device or VM you are currently receiving an error 0xc0000428 or that is starting into the recovery environment, you will need to follow the steps in the FAQ question for error 0xc0000428.
If you encounter these errors, you need to install the required updates listed in the How to get this update section of the update you are trying to install, or the required updates listed above in the Current status section of this article.
If you are seeing error 0xc0000428 with the message “Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.” please follow these steps to recover.
- Start the operating system using recovery media.
- Install the latest SHA-2 update (KB4474419) released August 13, 2019, using Deployment Image Servicing and Management (DISM) for Windows 7 SP1 and Windows Server 2008 R2 SP1.
- Reboot into the recovery media. This restart is required
- At the command prompt, run bcdboot.exe. This copies the boot files from the Windows directory and sets up the boot environment. See BCDBoot Command-Line Options for more details.
- Restart the operating system.
4970
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
