I recently purchased an authenticode certificate from globalsign and am having problems signing my files for deployment. There are a couple of .exe files that are generated by a project and then put into a .msi. When I sign the .exe files with the signtool the certificate is valid and they run fine. The problem is that when I build the .msi (using the visual studio setup project) the .exe files lose their signatures. So I can sign the .msi after it is built, but the installed .exe files continue the whole "unknown publisher" business. How can I retain the signature on these files for installation on the client machine?
3 Answers
Other option (The one that I'm doing) is creating the .msi first and then sign it using a pfx (certificate).
(I'm using a Code Signing Certificate that I bought at globalsign.com)
Open CMD: run -> powershell
Where the certificate is located run and save the thumbprint:
PS C:\Windows\system32> Get-PfxCertificate -FilePath .\CompanyCertificate.pfx
Will get something like this ABCFEDRABF229B78BF9C40EC47007C1234567890, you must replace your value in the following execution line.
Then find where the singtool.exe is located and go there (Win 10 in my case, the msi must be in the same path as well) and execute the following:
PS C:\Program Files (x86)\Windows Kits\10\App Certification Kit> .\signtool.exe sign /f CompanyCertificate.pfx /d "App Description" /p pfxPasswordHere /v /sha1 ABCFEDRABF229B78BF9C40EC47007C1234567890 /t "http://timestamp.comodoca.com/authenticode" MyApplicationSetup.msi
Number of files successfully Signed: 1
Number of warnings: 0
Number of errors: 0
Congrats you got it!
You will see this new tab under .msi properties:
And finally try to install it:
Related