How to fix "The timestamp signature and/or certificate could not be verified or is malformed"

This message is Windows error 0x80096005: the installer is signed, but Windows could not check the timestamp attached to that signature. Most often the PC lacks the root certificate behind the timestamp, or it is Windows 7 without SHA-2 support. Refresh the root certificates first, then run the installer again.

Facts checked on 16 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What "the timestamp signature and/or certificate could not be verified or is malformed" means

Microsoft's list of security and setup error codes (Winerror.h) gives this exact text to 0x80096005, TRUST_E_TIME_STAMP. Windows raises it while it checks the digital signature of a file, usually an installer, a .msi or .cab package or a driver.

A signed installer carries two signatures. The first is the publisher's. The second is a timestamp countersignature from a timestamp service, which proves when the file was signed, so the signature stays valid after the publisher's certificate expires. Both need a certificate chain that ends in a root Windows trusts. With 0x80096005 the publisher part can be fine; the timestamp part fails.

Why the timestamp signature cannot be verified

What stops the timestamp check decides the fix. From the most likely to the least likely:

How to fix "The timestamp signature and/or certificate could not be verified or is malformed"

Fixes 1 and 2 give Windows the root certificates the timestamp needs, which solves most cases. Fix 3 is for Windows 7 only. Fixes 4 to 6 cover a damaged installer, the clock and damaged system files.

Fix 1. Refresh the trusted root certificates so Windows can check the timestamp

5 minutesLow riskEveryone with internet, first. Especially when a proxy is set or a security suite filters web traffic.

Windows does not ship every Microsoft root. It fetches a missing one from ctldl.windowsupdate.com when a signature needs it. If that download is blocked, the timestamp's chain cannot be built and the check fails with 0x80096005.

1. Open Settings > Network & internet > Proxy. On Windows 10 open Settings > Network & Internet > Proxy.
2. Turn off Use a proxy server and Use setup script unless your work or school requires them.
3. Right-click Start and select Terminal (Admin). On Windows 10 select Windows PowerShell (Admin).
4. Run cd $env:TEMP to work in a folder you can write to.
5. Run certutil -generateSSTFromWU WURoots.sst. This downloads Microsoft's current trusted root list.
6. If it ends with CertUtil: -generateSSTFromWU command completed successfully., the path is open. Restart the PC and run the installer again.

Fix 2. Import the root certificates on an offline PC from a connected one

15 minutesLow riskThe PC has no internet, or has not been online for a long time, and an offline installer fails.

Microsoft's setup team explains that computers not connected to the internet never download the newer root certificates, so installers signed under them fail the trust check. The same list can be made on another PC and imported by hand.

1. On a PC with internet, open Terminal (Admin) and run certutil -generateSSTFromWU WURoots.sst in a folder you can find again.
2. Copy WURoots.sst to a USB drive and plug it into the offline PC.
3. On the offline PC press Win + R, type certlm.msc and select OK. Select Yes in the User Account Control prompt.
4. Expand Trusted Root Certification Authorities, right-click Certificates and select All Tasks > Import.
5. Select Next and Browse. Set the file type to **Microsoft Serialized Certificate Store (*.sst)** and open WURoots.sst.
6. Keep Place all certificates in the following store set to Trusted Root Certification Authorities, then select Next and Finish.
7. Run the installer again.

Fix 3. Install the SHA-2 code signing updates on Windows 7

20 to 40 minutesLow riskThe PC runs Windows 7 SP1, the most common place this message is reported.

Newer Microsoft installers and their timestamps are signed with SHA-2. A Windows 7 PC without SHA-2 code signing support cannot verify those signatures, so the timestamp check fails however good the root list is.

1. Open Control Panel > Programs and Features > View installed updates.
2. Look for KB4474419 (SHA-2 code signing support) and KB4490628 (servicing stack update).
3. If one is missing, download it from the Microsoft Update Catalog for Windows 7 for x64-based Systems or x86, to match your PC.
4. Install both and restart the PC.
5. Run Fix 1 so Windows also refreshes its roots, then run the installer again.

Fix 4. Download a fresh, current installer and check its signature

10 minutesLow riskOnly one installer fails, it came from a mirror or an old disc, or it is several years old.

A cut or altered download makes the signature data unreadable, which is the "malformed" half of the message. Users also report old installers whose timestamp certificate is no longer accepted; the publisher's current build is signed and timestamped again.

1. Delete the installer you have.
2. Download the current version from the publisher's own site. For the .NET Framework, that is the .NET Framework download page on dotnet.microsoft.com.
3. Right-click the new file, select Properties and open the Digital Signatures tab.
4. Select the signature and select Details. Digital Signature Information should say This digital signature is OK.
5. Check the Countersignatures list in the same window: it names the timestamp service and the signing time.
6. Run the installer again.

Fix 5. Check the clock and restart Cryptographic Services

5 minutesLow riskThe taskbar clock is wrong, or several signed files fail at the same time.

Signature checks compare certificate dates with the PC's clock, and they run through the Cryptographic Services service. A clock far off or a stuck service makes good signatures fail.

1. Compare the taskbar clock with your phone. If it is off, turn on Set time automatically and select Sync now. Step by step: How to fix the date and time in Windows
2. Press Win + R, type services.msc and select OK.
3. Double-click Cryptographic Services and make sure Startup type is Automatic.
4. Select Stop, then Start, and OK. More detail: Check and restart Windows services
5. Run the installer again.

Fix 6. Repair system files with DISM and SFC

20 to 30 minutesLow riskSeveral signed programs fail, or Fixes 1 to 5 did not help.

In rare cases a damaged crypto component makes every signature or timestamp check fail. DISM repairs the component store and SFC then restores damaged system files from it.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.
2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

If the timestamp error is still there

The logs and the signature details show which file fails and whose timestamp it carries. That tells you whether the PC lacks a root or the file itself is the problem.

• Repair the .NET Framework itself when its setup still fails after the roots are in place: How to repair Microsoft Visual C++ Redistributable and .NET Framework
• Work or school PC: send IT the code 0x80096005, the file name and the certutil result. Root updates and proxies are set by policy there.
• Another vendor's installer (a driver, a security agent): send the vendor the file name and the timestamp details; they may need to re-sign it.
• Home PC, nothing helped: reinstall Windows over itself and keep files and apps: Reinstall Windows without losing files
• Windows 10: support ended on 14 October 2025. Check that the PC is in Extended Security Updates or plan the move to Windows 11.

How to keep the timestamp error from coming back

Frequently asked questions

What does "the timestamp signature and/or certificate could not be verified or is malformed" mean?

It means Windows checked a signed file and could not verify the timestamp attached to its signature. Microsoft's code for it is 0x80096005, TRUST_E_TIME_STAMP. The timestamp proves when the file was signed, and it has its own certificate chain. When the root behind that chain is missing, or Windows cannot read the signature type, the check fails. The file is usually fine; the PC is missing something. Start with Fix 1.

How do I fix it on Windows 7?

Install the SHA-2 code signing update KB4474419 and the servicing stack update KB4490628 from the Microsoft Update Catalog, restart, then refresh the roots with Fix 1. Most reports of this message come from Windows 7, where newer SHA-2 timestamps cannot be verified without those updates. Keep in mind that Windows 7 support ended on 14 January 2020, so a working installer does not make the PC safe to use online.

Why does the .NET Framework installer show this error?

The .NET Framework setup checks the signatures of its own packages before it installs them. On a PC that is offline, or has not refreshed its root certificates for years, the root behind the newer Microsoft timestamp is missing, and the check stops with this message. Refresh the roots (Fix 1) or import them on an offline PC (Fix 2), then run the setup again. On Windows 7 add SHA-2 support first (Fix 3).

Is it the same as "the timestamp signature and/or certificate" error in Visual Studio or SQL Server setup?

Yes, the text and the code 0x80096005 are the same wherever they appear. Visual Studio and SQL Server setups list each package they reject, often next to the related message about a certificate chain that could not be built to a trusted root authority. Both come from missing roots in most cases. Refresh the roots, then repair or rerun the setup. Very old builds may need a current installer from Microsoft (Fix 4).

What is TimeStamperCertificate in Get-AuthenticodeSignature?

Get-AuthenticodeSignature in PowerShell returns a signature object for a file. Its SignerCertificate property is the publisher's certificate, and TimeStamperCertificate is the certificate of the timestamp service that countersigned it. When the timestamp check fails, Status is not Valid and StatusMessage repeats the timestamp error text. Run the command with Format-List to see both certificates and find which issuer your PC does not trust. Microsoft documents the cmdlet on Microsoft Learn.

What does "signature verification failed: timestamp too old" mean?

That is a different message from a different place. It comes from web services and libraries that sign requests with the current time and reject a request whose time is too far in the past. It is not the Windows code 0x80096005. The usual cause is a client clock that is off or a request sent late. Sync the clock on the machine that sends the request (Fix 5 shows how on Windows) and send it again.

What is "error while getting signaturetimestamp"?

That phrase is not a Windows signature error, and we could not confirm which program prints it. It does not come from the Windows trust check this page covers, so the fixes here will not help with it. If you see it in a downloader, media tool or browser extension, update that program to its latest version and check its own support page. This page is about the Windows message with code 0x80096005.

Should I disable driver signature enforcement or code signing checks?

No. Turning off signature checks does not repair the timestamp; it only stops Windows from checking anything, which lets tampered drivers and files load. The old advice to disable code signing of driver packages is not a fix for this message. The cause is a missing root or missing SHA-2 support, and Fixes 1 to 3 add what is missing while all protections stay on.

I searched in another language. Is this the right page?

Yes, if the code 0x80096005 or this message was on your screen. Some readers arrive with searches such as o que fazer?, which is Portuguese for what should I do. The meaning is the same in every language of Windows: the timestamp on a signed installer could not be verified. The fixes work the same on a Windows set to Portuguese, Spanish or any other language; only the menu names are translated.