You set up code signing on your updater, everything works, and for a couple of years you don’t need to touch it. 

Then your certificate expires. 

You renew it, same company, same CA, same everything. 

Except the subject line comes back slightly different. Maybe a locality field got added that wasn’t there before. 

Maybe something else changed. 

Your updater does an exact match, it doesn’t match, and it silently breaks. Usually right when you’re trying to ship an update.

This isn’t a hypothetical. It’s a real scenario that catches people off guard regularly, and it’s one of those problems that’s hard to diagnose because the updater just fails quietly rather than giving you a clear reason why.

Advanced Installer 23.9 has a fix for it.

**Why Subject-Based validation is fragile**

The traditional approach to certificate validation in Updater is checking the subject fields: CN for the company name, O for the organization, sometimes L for locality, E for email, and so on.

The problem is you don’t fully control what goes into the subject line. Certificate issuers change their requirements over time. A field that wasn’t required two or three years ago may be required today, or vice versa. 

Every time you renew or switch issuers, there’s a real chance the new certificate’s subject line doesn’t match the old one exactly. And if your updater does an exact match, it breaks.

Checking only CN or O helps a little but it’s still fragile. A company name alone isn’t unique, which opens the door to a different set of problems.

**The fix: Expected Identity OID**

For certificates issued through Microsoft Trusted Signing, there’s a more reliable field to check that has nothing to do with the subject line.

When Microsoft verifies your company’s identity for code signing, they assign a policy OID tied to that specific verified identity. 

When you renew your certificate, Microsoft reissues it under the same verified identity. 

The OID stays exactly the same even if the subject line changes.

That’s what the Expected Identity OID field in Advanced Installer 23.9 checks. 

Instead of matching subject fields, you tell the Updater what OID the certificate must carry. 

If it matches, the update is trusted. If it doesn’t, it’s rejected regardless of what the subject line looks like.

If your code signing certificate comes from one of those providers, Expected Identity OID won’t have anything meaningful to validate against. 

For third-party certificates, subject-based matching scoped to CN or O rather than the full subject is still the more stable approach.

**Watch the full setup**

The video covers why subject-based validation breaks, how Expected Identity OID works, how to configure it in your project, and includes a step-by-step demo showing the updater checking certificate identity and rejecting mismatched certificates.

Watch it here:[ https://youtu.be/ltG6Gm0AdHg?si=LL44hq7Wfdd8jgFy](https://youtu.be/ltG6Gm0AdHg?si=LL44hq7Wfdd8jgFy)

Questions about certificate validation setup or running into something specific after the 23.9 upgrade? Drop them below.



Same company, same certificate authority, renewed certificate. and your updater breaks because one field changed. Advanced Installer 23.9 addresses exactly this