9

I have made a little tool. It is a console application that when running on Win7 brings the UAC security prompt. I tried to sign this EXE file in Visual Studio 2010 using the following steps:

  1. Project properties
  2. Signing
  3. Create new key as shown below

enter image description here

The key file was successfully created, as you can see in the capture below.

enter image description here

Issues:

File is still being blocked by the UAC security prompt. When I checked the file whether signed or not using the signtool.exe, it tells me, no signature was found. Please correct me if I'm following the wrong steps.

enter image description here

RBT
  • 24,161
  • 21
  • 159
  • 240
joe
  • 546
  • 1
  • 6
  • 20
  • For authenticode based code-signing - [How do I create a self-signed certificate for code signing on Windows?](https://stackoverflow.com/q/84847/465053) – RBT Aug 31 '21 at 09:14

2 Answers2

17

Assembly signing != Authenticode signing.

To authenticode sign an assembly with signtool, you'll need a code signing certificate from a trusted issuing authority.

You can then issue the following post-build command to sign your executable:

"signtool.exe" sign /f "$(SolutionDir)myCertificate.pfx" /p certPassword /d "description" /du "http://myinfourl" /t "http://timeserver.from.cert.authority/" $(TargetPath)

Everything you need to know about Authenticode Code Signing

spender
  • 117,338
  • 33
  • 229
  • 351
  • 2
    worked fine, also, many parameters are optional in the command above. this is what i used : signtool sign /f MyCert.pfx /p MyPassword MyApp.exe – joe May 21 '13 at 16:02
  • 2
    Is there no GUI way to do this? – A X May 31 '21 at 20:32
8

Basically you have 2 options, using a command that you manually execute or execute via a batch file

signtool.exe sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /f "D:\Source\Certificates\CodeSign.pfx" /as /p MyPassword "{path to exe}"

becomes a bit frustrating after a while Better add it on your project's option page in the Build Events.

In your post build you would enter

call "C:\Program Files (x86)\Windows Kits\10\bin\x64\signtool.exe" sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /f "D:\Source\Certificates\CodeSign.pfx" /p MyPassword  $(TargetPath)

the Macro $(TargetPath) will be filled with the path to your compiled exe or dll.

Now each time you compile you will get a signed file.

Would look something like this: Project property page

Walter Verhoeven
  • 3,867
  • 27
  • 36
  • By the way, you can download signtool.exe from Microsoft, there are quite a few google "Window Kits Download", I use windows 10 so I'd use https://developer.microsoft.com/en-us/windows/downloads/windows-10-sdk – Walter Verhoeven Jan 13 '18 at 20:53
  • Thanks this is what I was looking for! In my case, because my path was sooo long I had to wrap the macro in quotes i.e. - "$(TargetPath)" – Kevin Moore Nov 08 '19 at 23:00
  • You're welcome. Please note that you can also sign exe and dll's using https://www.digicert.com/util/ this is a nice tool as it also allows you to trouble shoot issues with certificates – Walter Verhoeven Nov 13 '19 at 20:57