How to Verify the Digital Signature of Venafi Installation Files

Venafi digitally signs its installation files (e.g. Microsoft MSI and Linux RPM) to prevent tampering. Digitally signed install files provide a secure method for customers to verify that the software they install is from Venafi and that it has not been modified by another party.

Digital signatures are based on digital certificates and help to establish the following security measures:

• Authenticity
• Integrity
• Non-repudiation

1. Right-click on a Venafi MSI file and click Properties.
2. In the Properties dialog box, click the Digital Signatures tab.
3. From the Signature list, locate and click Venafi, Inc., and then click Details. 
   
   
   
   
4. In the Digital Signature Details box, carefully review the signer information and certificate details to ensure that the certificate is authentic and belongs to Venafi, Inc. 

You can verify the digital signature of an extracted RPM file using one or more of the following commands. They are listed in order of a simpler to a more complex verification.

• To quickly verify that the RPM file you extracted from a Venafi tarball, run the following command; this simply lets you know that the RPM file was signed but does not provide the level of detail offered by the other commands listed below. 

• If you want to perform a more thorough verification of an RPM file from Venafi, then you must import the Venafi RPM signing public key into your RPM key database.
  
  NOTE: Before running this command, you must first download the public key from the Venafi support site.  

• To perform a general signature verification showing that an RPM came from a tarball downloaded from the Venafi FTP site, use the following command.
  
  NOTE: You must run the previous command first (rpm --import) so that the public key is already imported into your RPM key database. 

• To perform the most thorough verification, run the following command. 
  
  NOTE: As with the previous command, you must run the rpm --import command first so that the public key is already imported into your RPM key database.