We are excited to announce that the IIS.NET Forums are moving to the new Microsoft Q&A experience. Learn more >

Installing IIS CORS 1.0 Module finishes with "Downloaded file failed signature verification and may have been tampered with" messageRSS

4 replies

Last post Mar 15, 2021 02:55 PM by fw-flw

‹ Previous Thread|Next Thread ›
  • aliaksanderkazlou aliaksanderk...

    1 Post

    Installing IIS CORS 1.0 Module finishes with "Downloaded file failed signature verification and m...

    Jan 18, 2021 12:04 PM|aliaksanderkazlou|LINK

    Hi, hope you're doing well.

    We're trying to install IIS CORS module via Web Platform Installer.

    Here's the command:

    webpicmd.exe /Install /Products:"CORS 1.0" /AcceptEula

    For a while it worked well, but starting last Friday (January 15th 2021), we are getting this error:

    Downloaded file failed signature verification and may have been tampered with

    Are there any changed been made for this file? We cannot understand the issue.

    Thanks a lot for your help.

  • Trever_G Trever_G

    1 Post

    Re: Installing IIS CORS 1.0 Module finishes with "Downloaded file failed signature verification a...

    Jan 18, 2021 03:08 PM|Trever_G|LINK

    We are also getting the same error. This error occurs with both manually running the web platform installer, and using the command line mentioned above.

  • samwu samwu

    365 Posts

    Re: Installing IIS CORS 1.0 Module finishes with "Downloaded file failed signature verification a...

    Jan 19, 2021 01:59 AM|samwu|LINK

    Hi aliaksanderkazlou,

    aliaksanderkazlou

    Downloaded file failed signature verification and may have been tampered with

    This problem should be caused by system compatibility. The default version installed by Web Platform Installer (WebPI) is x86 installer, you can try to install x64 installer.

    Best regards,

    Sam

    IIS.NET forums are moving to a new home on Microsoft Q&A, we encourage you to go to Microsoft Q&A for .NET for posting new questions and get involved today. Learn more >
  • RPisarzJr RPisarzJr

    1 Post

    Re: Installing IIS CORS 1.0 Module finishes with "Downloaded file failed signature verification a...

    Jan 26, 2021 02:40 PM|RPisarzJr|LINK

    I have tried the x64 installer... it appears to run but CORS still not installed. I think there is still an issue with the installer.

  • fw-flw fw-flw

    14 Posts

    Re: Installing IIS CORS 1.0 Module finishes with "Downloaded file failed signature verification a...

    Mar 15, 2021 02:55 PM|fw-flw|LINK

    The problem is plain and simply what the error message states:

    The SHA1 checksum from the Web Platform Installer's XML feed does not match the actual SHA1 checksum of the installer file.

    You can try this by downloading the file manually from http://download.microsoft.com/download/2/F/2/2F259559-FC43-4B2C-B53F-DED3E9950912/IISCORS_amd64.msi and running

    certutil -hashfile c:\Users\you\Downloads\IISCORS_amd64.msi SHA1
SHA1 hash of c:\Users\you\Downloads\IISCORS_amd64.msi:
9f9cb65df2248aec014197122cb79117b7189167
CertUtil: -hashfile command completed successfully.

    You can verify this further by downloading the original feed file from https://webpifeed.blob.core.windows.net/webpifeed/WebProductList.xml, then editing it in a text editor and replacing the incorrect SHA1 hash with the correct one. Then run

    webpicmd-x64 /Install /products:cors /xml:C:\path\to\edited-version-of\WebProductList.xml

    and - surprise - it will work.

    Except...

    DON'T DO THIS!

    For all we know, someone may actually have tampered with Microsoft's download server. You'd say: Probably not. After all, this is Microsoft. But Microsoft is also the same company that hasn't fixed this hash mismatch for at least 3 months (and counting, at the time of this writing). If you still trust them, read on...

    All this does is show that Microsoft are doing an extremely sloppy job at maintaining WebPi packages. It's almost as if WebPi is something they have already abandoned, but without providing a proper replacement.

    Also, if you have been paying attention, the download URL is a HTTP URL. That's right. No HTTPS.

    And then you have only scratched the surface of what a dumpster fire WebPi is. The best advice I can give you is to stop using it immediately.

    Either download the MSI file directly and run it (it will not install all dependencies, but all dependencies, such as IIS, can be installed with DISM or Server Manager), or, if you want to use a package manager, consider using Chocolatey: https://chocolatey.org/packages/iis-cors-module .

Shortcuts

‹ Previous Thread|Next Thread ›