Notepad++ v8.8.3 Release: self-signed certificate

donho

Notepad++ release 8.8.3 virus scanner issue? Please check the following link:
https://notepad-plus-plus.org/news/v883-self-signed-certificate/

Notepad++ v8.8.3 security-fixes & new enhancement:

Use self-signed certificate to sign new release binaries. (Implement commit)
Fix uninstaller security issue (CVE-2025-49144). (Fix #16787)
Enhance security for DLL loading. (Fix #13964)

Notepad++ v8.8.2 regression-fixes, bug-fixes & new features:

Fix regression of folding state not being remembered through sessions. (Fix #16597, #16670)
Fix “Go To Settings” links in Style Configurator regression (from v8.8). (Fix #16592)
Fix small regression of tab background (hovered) highlighting issue after drag&drop. (Fix #16559)
Fix an unresponsive (hang) issue due to hide lines. (Fix #16316)
Fix installer security issue by using the absolute path instead of an unspecified path (CVE-2025-49144). (commit, fix report on GitHub, fix #16744)
Installer component “WinGUp”: update cURL to 8.13.0 for fixing cURL’s security issue CVE-2025-0167. (Fix #16531, #16515)
Update to scintilla 5.5.7 & Lexilla 5.4.5. (Implement #16649)
Add feature to update Notepad++ on exit. (Fix #16601, #13749, #10317, #8495, #8457, #3755)
Add “/relaunchNppAfterSilentInstall” command argument for installer. (Fix #issue)
Add feature to set read-only attribute on file so user can toggle (set/remove) read-only attribute of a file. (Fix #326, #4594, #6216, #7841, #12520, #15571, #16603)
Add new plugin API: NPPM_GETTOOLBARICONSETMODE & NPPN_TOOLBARICONSETCHANGED to get toolbar icon set choice. (Fix #16547, #16646)
Deprecate 3 APIs: Deprecate NPPM_GETOPENFILENAMES, NPPM_GETOPENFILENAMESPRIMARY & NPPM_GETOPENFILENAMESSECOND. (Fix #15997)
Add new feature of using first line of untitled document for its tab name. (Fix #3994, #16584)
Enhance NPPM_DARKMODESUBCLASSANDTHEME: Enable darkmode progress bar for plugins. (Fix #16675)
Various dark mode enhancements. (Fix #16668, #16674, #16560, #16537, #issue)
Fix right click on caption bar unhidding main menu. (Fix #16652)
Fix rename tab error message when tab name is unchanged. (Fix #16661)
Fix Python FunctionList absorbing next function issue if space after colon. (Fix #16636)
Remove .log from errorlist lexer’s default extensions. (Fix #16627)
Make raw string syntax highlighting work for Golang. (Fix #16609)
Fix Notepad++ tray icon lost after Windows Taskbar crashing & being relaunched. (Fix #16588)
Fix changing toolbar icon set not updating to matching panel icon set. (Fix #16595)
Fix Windows dialog file list not react with keystroke (character match). (Fix #2239)
Add “*” mark on modified file entries in “Windows” dropdown menu. (Fix #16542)

Auto-update will be triggered in 3 days for this release.

PGomersall

Looks like none of the crt files will download correctly now; they were working a while ago. It does not download as a valid cert.

PeterJones

@PGomersall said in Notepad++ v8.8.3 Release: self-signed certificate:

Looks like none of the crt files will download correctly now; they were working a while ago. It does not download as a valid cert.

Might be something on your end. I just tried all three, and they did what I expected

Primary Location: https://notepad-plus-plus.org/nppRoot.crt => downloaded file
Secondary Location: https://github.com/notepad-plus-plus/notepad-plus-plus/blob/master/nppRoot.crt => takes you to the GitHub wrapper, where you can download the raw file
Tertiary Location: https://npp-user-manual.org/docs/certs/nppRoot.crt => downloaded file

PGomersall

@PeterJones said in Notepad++ v8.8.3 Release: self-signed certificate:

Might be something on your end. I just tried all three, and they did what I expected

Tried multiple systems all using MS Edge browser though but also via PowerShell with Invoke-WebRequest, all are returning a plain txt.

Approximately 1 hour ago it did download correctly.

Just tried 4 computer and Chrome and FDM - same result

PeterJones

@PGomersall said in Notepad++ v8.8.3 Release: self-signed certificate:

Tried multiple systems all using MS Edge browser though but also via PowerShell with Invoke-WebRequest, all are returning a plain txt.

My post from 20 minutes ago was after I verified in Chrome. And I just now tried PowerShell

PS C:\Users\pryrt> cd Downloads                                                                                                                                                     PS C:\Users\pryrt\Downloads>  Invoke-WebRequest https://notepad-plus-plus.org/nppRoot.crt


StatusCode        : 200
StatusDescription : OK
Content           : {45, 45, 45, 45...}
RawContent        : HTTP/1.1 200 OK
                    Connection: keep-alive
                    platform: hostinger
                    panel: hpanel
                    content-security-policy: upgrade-insecure-requests
                    alt-svc: h3=":443"; ma=86400
                    x-hcdn-request-id: a5305815b661c200e85fa1...
Headers           : {[Connection, keep-alive], [platform, hostinger], [panel, hpanel], [content-security-policy, upgrade-insecure-requests]...}
RawContentLength  : 6380



PS C:\Users\pryrt\Downloads> Invoke-WebRequest https://npp-user-manual.org/docs/certs/nppRoot.crt


StatusCode        : 200
StatusDescription : OK
Content           : {45, 45, 45, 45...}
RawContent        : HTTP/1.1 200 OK
                    Connection: Keep-Alive
                    Keep-Alive: timeout=5, max=100
                    platform: hostinger
                    panel: hpanel
                    content-security-policy: upgrade-insecure-requests
                    alt-svc: h3=":443"; ma=2592000, h3-29="...
Headers           : {[Connection, Keep-Alive], [Keep-Alive, timeout=5, max=100], [platform, hostinger], [panel, hpanel]...}
RawContentLength  : 6380

It’s still working for me.

Approximately 1 hour ago it did download correctly.

And it’s still downloading correctly now, for me.

Out of curiousity, I ssh’d into a remote linux machine (which would use a different route/path between that machine and the upstream servers) – and both of those had errors. So there might be a routing issue between some providers and the various notepad++ servers.

yeah, I tried a tracert notepad-plus-plus.org from my PC , and it was able to find a route; but when I did tracert notepad-plus-plus.org from the remote machine, which has a different route to Notepad++, it wasn’t able to find a route.

So there might be a network issue somewhere between the Notepad++ servers (both are on the same hosting system, I think) and some other networks, but not all (since I still have access from my home internet connection)

PGomersall

@PeterJones
I just got https://notepad-plus-plus.org/nppRoot.crt to download correctly, but not the other 2 locations. Really need this to be bomb proof.

PeterJones

@PGomersall said in Notepad++ v8.8.3 Release: self-signed certificate:

Really need this to be bomb proof.

The second site is GitHub. And as I said in my earlier message with the URLs, the GitHub URL doesn’t return the raw cert, it returns the GitHub wrapper around the cert; you have to use the GitHub interface to download the raw. If you want a direct URL to the raw file, it’s at https://raw.githubusercontent.com/notepad-plus-plus/notepad-plus-plus/refs/heads/master/nppRoot.crt … but note that GitHub will give it text/plain headers (because inside, a .cer is often a BASE64-encoded file starting with -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE-----…

So, for that matter, the certificates downloaded from the other URLs will be “plain text” as well. The question is what are the contents of that plain text. And you haven’t given any hint as to that.

Checking the contents you are receiving is really the next step. The hosting service that Don uses for Notepad++ websites often uses the “are you a human” checks to prevent DDOS attacks – so you might actually be getting a “403 Forbidden” error, especially when using the command-line based interfaces instead of a browser. So the contents might be either an error message, or an HTML version of an error message.

So if there are network/route errors, Don cannot do anything to fix that. If you are being “forbidden” because you haven’t done the “are you a human check”, there’s nothing Don can do to fix that. And if you are going to the non-raw github URL, it will of course be the github-wrapped version.

donho

@PeterJones

Sorry if I wasn’t fast enough for the Release Notes…

Better late than never (Not sure it exists in English, but the French sentence is “Mieux vaut tard que jamais”).

Updated. Please check:
https://notepad-plus-plus.org/downloads/v8.8.3/
https://notepad-plus-plus.org/news/v883-self-signed-certificate/
https://notepad-plus-plus.org/resources/
and
https://github.com/notepad-plus-plus/notepad-plus-plus/tree/master

Jordi Sole

Good Morning

I downloaded the latest version of N++ and I installed the certificate npproot.crt.
When I try to execute npp.8.8.3.Installer.exe it appears the following screen

With npp.8.8.2.Installer.exe it’s ok.

Any suggestion?

xomx

@Jordi-Sole said in Notepad++ v8.8.3 Release: self-signed certificate:

Any suggestion?

Just wait for a while, the AVs need some time to handle (update its info) the new Notepad++ self-signed certificate.

I just tried the VirusTotal and ok (much much better from what we saw at the unsigned v8.8.2 release time - only 1 AV from 72 flagged the npp.8.8.3.Installer.x64.exe as malware):

https://www.virustotal.com/gui/file/7094a07167648628e47249a16d9d6db922e5aa1255ac4322a2e4900d233372dd

sevem47

For me it seems, that the information for the root certificate in the user manual got somehow mixed up a little bit.
Thumbprint value is taken of the current root certificate, whereas value of the serial number is of the previous certificate.

PeterJones

@sevem47 said in Notepad++ v8.8.3 Release: self-signed certificate:

Thumbprint value is taken of the current root certificate, whereas value of the serial number is of the previous certificate.

Both values match what was published in this post and this page