On behalf of the security.nl community to our english speaking friends: Take some notice that the original subject-title of this thread can be misleading. There is actually no problem at all with the certificates here. The certificate-chain in the digital signature of EMET4.1 update1.msi has proven to be just fine. But we found that the actual problem merely is caused by difficulties in the reading of digital signatures using sha256 by older Windows systems, like Vista, XP SP3 and (as we 've heard) also Windows 2003 Server. This probably causes the annoying errors in the digital signature of the EMET4.1 update1.msi file. (open the "digital signature"-tab in "Properties", and check the details) Remarkable is also that no "countersignature" is showing up in "fully patched" Vista or XP (SP3) systems. For now (as far as we from the security.nl community can see) this phenomenon is most likely caused by a different Authenticode structure in case sha256 has been used. Such structures seem to be incorrectly ...