<p>There are various signatures tha you can use to ensure the integrity of your MultiBit downloads.</p>

<p>The 0.5.18 release notes have SHA256 hashes of the binaries:
<a href="https://multibit.org/releases/multibit-0.5.18/release.txt" rel="nofollow">https://multibit.org/releases/multibit-0.5.18/release.txt</a></p>

<p>You can check the SHA256 hash of the file you have and it should match.
If it does NOT match then DO NOT USE it. </p>

<p>Try downloading it again from <a href="https://multibit.org" rel="nofollow">https://multibit.org</a>. It could be that it the download failed.</p>

CC BY-SA 3.0
2015-06-06T14:07:42.957Z
I realize the first non-beta release of MultiBit HD is right around the corner (congrats!) and probably consuming most of your time, but if you plan to keep MultiBit Classic around for a little while, you may want to fix [this cert. expiration issue](http://bitcoin.stackexchange.com/questions/37778/download-of-multibit-windows-64-bit-has-corrupt-signature/37786#37786)....
Christopher Gurnee
CC BY-SA 3.0
2015-06-04T10:12:58.547Z
2015-06-04T10:12:58.547Z
jim618
<p>Signed Windows binaries have a "main" signature, and they can optionally have one or more "countersignatures", typically from timestamping services.</p>

<p>I downloaded the MultiBit Windows installer* from <a href="https://multibit.org/" rel="nofollow noreferrer">https://multibit.org/</a> and verified its GPG signature. The file I downloaded has a valid main signature, but it has an invalid countersignature because the timestamping countersigner's (COMODO's) certificate appears to have expired on May 10.</p>

<p>If the signature error message you're getting (right click the file, click Properties, click the Digital Signatures tab, click "sha1", click Details) is "One of the countersignatures is not valid", then it's <em>probably</em> safe to install.</p>

<p><strong>However I'd still strongly recommend you follow <a href="https://bitcoin.stackexchange.com/users/888/jim618">jim618</a>'s advice</strong> and verify the file via another means before running it.</p>

<p><sub>*My download had an SHA-256 of: dc0c2ef689507c57347c0cbed58ea90fe12617a6fb026b308e81ec2127531b7e</sub></p>

CC BY-SA 3.0
2015-06-04T13:28:53.193Z
2015-06-04T13:28:53.193Z
2017-04-13T12:47:33.583Z
Christopher Gurnee
<p>I'm trying to download Multibit from <a href="https://multibit.org/community.html" rel="nofollow">https://multibit.org/community.html</a> the Win 64 version.</p>

<p>it consistently gives a 'The signature of multibit-0.5.18-windows-setup.exe is corrupt of invalid.'</p>

<p>is anyone else experiencing this?  Any Suggestions?</p>

<multibit><signature>
Download of Multibit Windows 64 Bit has corrupt signature
RAM
# Download of Multibit Windows 64 Bit has corrupt signature

(Asked by: username_0 on 2015-06-04)

I'm trying to download Multibit from <https://multibit.org/community.html> the Win 64 version.

it consistently gives a 'The signature of multibit-0.5.18-windows-setup.exe is corrupt of invalid.'

is anyone else experiencing this? Any Suggestions?

**Tags:** multibit, signature


---

## 2 answers

### Answer by username_1 on 2015-06-04. Score: 1

There are various signatures tha you can use to ensure the integrity of your MultiBit downloads.

The 0.5.18 release notes have SHA256 hashes of the binaries:
<https://multibit.org/releases/multibit-0.5.18/release.txt>

You can check the SHA256 hash of the file you have and it should match.
If it does NOT match then DO NOT USE it.

Try downloading it again from <https://multibit.org>. It could be that it the download failed.

> **Comments:**
> **username_2**: I realize the first non-beta release of MultiBit HD is right around the corner (congrats!) and probably consuming most of your time, but if you plan to keep MultiBit Classic around for a little while, you may want to fix [this cert. expiration issue](http://bitcoin.stackexchange.com/questions/37778/download-of-multibit-windows-64-bit-has-corrupt-signature/37786#37786)....  

---

### Answer by username_2 on 2015-06-04. Score: 0

Signed Windows binaries have a "main" signature, and they can optionally have one or more "countersignatures", typically from timestamping services.

I downloaded the MultiBit Windows installer\* from <https://multibit.org/> and verified its GPG signature. The file I downloaded has a valid main signature, but it has an invalid countersignature because the timestamping countersigner's (COMODO's) certificate appears to have expired on May 10.

If the signature error message you're getting (right click the file, click Properties, click the Digital Signatures tab, click "sha1", click Details) is "One of the countersignatures is not valid", then it's *probably* safe to install.

**However I'd still strongly recommend you follow [username_1](https://bitcoin.stackexchange.com/users/888/username_1)'s advice** and verify the file via another means before running it.

\*My download had an SHA-256 of: dc0c2ef689507c57347c0cbed58ea90fe12617a6fb026b308e81ec2127531b7e


---

