Signtool error: No certificates were found that met all given criteria with a Windows Store App?

Question

I'm trying to sign a Windows 8 appx package with a pfx file I have. I'm using a command like so:

signtool.exe sign /fd sha256 /f "key.pfx" "app.appx"

And from this, I get:

SignTool Error: No certificates were found that met all the given criteria.

What "criteria" am I not meeting? This is only for testing so these are self-signed certificates. I've tried importing the key and then signing it, but it always results in the same error. How do I fix this?

I think that `Signtool` is trying to find the certificate in the trusted root certificates store and you have no code signing certificates there. — crea7or, Apr 08 '14 at 22:16
I had this error it was because the certificate that was used for the signing had expired — Mark Homer, Nov 04 '15 at 10:06
I had a similar issue and posted an [answer](https://stackoverflow.com/a/57951142/776075) here. Hope this helps. — SurenSaluka, Sep 16 '19 at 06:11

JDandChips · Answer 1 · 2015-03-13T12:02:26.330

740

When getting this error through Visual Studio it was because there was a signing certificate setup to match the computer it was originally developed on.

You can check this by going to the project properties > signing tab and checking the certificate details.

You can uncheck "Sign the ClickOnce manifests" to disable signing.

Signing Properties

If you don't want to turn this option off you will have to install the certificate.

edited Mar 13 '15 at 12:02

answered Dec 16 '14 at 14:55

JDandChips

9,780
3
30
46

16

Just to add to what @JDandChips suggested: For debugging and testing purposes you can also use a temporary test certificate by clicking on the 'Create Test Certificate' button shown in the screenshot above. – nam Jul 30 '15 at 15:31
What do you mean "install the certificate"? – Sean Kendle Mar 15 '16 at 21:50
In my situation the certificate was available from the machine it was originally developed on, so I could choose "Select from File..." to install the missing certificate. Alternatively you can always create a new one and use that! – JDandChips Mar 16 '16 at 10:32
1

@JDandChips How do you create a new certificate? – erotavlas Nov 29 '16 at 17:05
7

For VS newbies. Ensure you right-click on the project, not the solution, because that will popup an entirely different menu! – B5A7 Jun 02 '17 at 03:30
I am having this issue after changing the administrator password of my build machine. I don't have VS to open the solution in build machine so I did re-install the certificate again in both places, Personal/Certificates and Trusted Root Certification Authority/Certificates. Still bad luck did you guys came up with this scenario – OmGanesh Jan 14 '19 at 12:20
Note for people who prefer JetBrains products: You _have_ to use VS for this. Rider doesn't seem to support this kind of certificate. – Hutch Moore Dec 08 '20 at 18:11
This was the solution for me - with that difference, that the project was old and the test certificate just had to be _renewed_. – Gustav Dec 18 '20 at 11:47

score 172 · Answer 2 · edited Dec 23 '22 at 23:43

172

Try with /debug.^1,2 As in :

signtool sign /debug /f mypfxfile.pfx /p <password> (mydllexectuable).exe

It will help you find out what is going on. You should get output like this:

The following certificates were considered:
    Issued to: <issuer>
    Issued by: <certificate authority> Class 2 Primary Intermediate Server CA
    Expires:   Sun Mar 01 14:18:23 2015
    SHA1 hash: DD0000000000000000000000000000000000D93E

    Issued to: <certificate authority> Certification Authority
    Issued by: <certificate authority> Certification Authority
    Expires:   Wed Sep 17 12:46:36 2036
    SHA1 hash: 3E0000000000000000000000000000000000000F

After EKU filter, 2 certs were left.
After expiry filter, 2 certs were left.
After Private Key filter, 0 certs were left.
SignTool Error: No certificates were found that met all the given criteria.

You can see what filter is causing your certificate to not work, or if no certificates were considered.

I changed the hashes and other info, but you should get the idea.

¹ _{Please note: signtool is particular about where the /debug option is placed. It needs to go after the sign statement.}
² _{Also note: the /debug option only works with some versions of signtool. The WDK version has the option, whereas the Windows SDK version does not.}

edited Dec 23 '22 at 23:43

starball

20,030
7
43
238

answered Apr 14 '14 at 04:26

Daniel

1,845
1
10
4

6

Works for me. Not that I understand the response from signtool, but /debug did what it should. Upvote! – noelicus Feb 09 '15 at 21:00
1

This command is particular with where you put the /debug If you put it out of order, it will report an error. – Daniel Feb 21 '15 at 08:28
15

/debug works for specific versions of signtool.exe only. The one that comes with the WDK provides this option, the one from the Windows SDK does not. – Paul Kertscher Feb 24 '15 at 08:03
3

Also, /debug must go after signtool sign, not in between. – Denis V Jul 17 '15 at 07:02
1

Shows that my certificate expired. Good Job. – Observer Sep 02 '15 at 14:02
1

I tried this, and it does list the certificates its trying to match, but apart from that I dont know how should I be proceeding with this information. Any help would be appriciated – dhiraj suvarna Nov 29 '16 at 14:53
The /debug parameter lists the computer certificates that it's looking for and then tells you why or if it filtered some out. It helped remind me that code signing certs are seeked out in the computer container (perhaps by default?), not in the user container. – AbeyMarquez Nov 24 '20 at 20:01

Muhammad Faizan Khan · Answer 3 · 2019-12-12T10:07:39.463

60

I got the same problem in my console application development and as a quick workaround,

go to project properties then,

click on signing tab and uncheck "Sign the ClickOnce Manifest".

Image Description:

FYI You can also see this less one minute video solution. The above picture is taken form the video.

edited Dec 12 '19 at 10:07

answered Nov 12 '19 at 04:49

Muhammad Faizan Khan

10,013
18
97
186

1

You can also click on create test certificate to carry on. thanks – MindRoasterMir Apr 26 '20 at 20:25
1

Unchecking this box means when third parties try to install your software off the web, Windows Security will block the app from running. You need a proper code signing cert, and you must sign the ClickOne manifest with it. – Chris Bordeman Jul 08 '20 at 02:05
@ChrisBordeman Thanks for the info! I just shared a quick solution so that development should not stop:) Anyway security feature should need to be fixed properly as you mentioned. – Muhammad Faizan Khan Jul 17 '20 at 06:59
Be aware that if the application was already deployed with a certificate prior to the error and you then uncheck this, for end users it will be like installing a new application. This also means they won't be able to auto-update. As long as you don't deploy, this could be a quick workaround but you will have to fix this before redploying. – bkqc Sep 01 '20 at 18:04
it worked for me in a wpf desktop app. – MindRoasterMir Sep 13 '22 at 08:31

score 43 · Answer 4 · edited Jun 01 '17 at 12:32

43

Please always check your certificate expiry date first because most of the certificates have an expiry date. In my case certificate has expired and I was trying to build project.

edited Jun 01 '17 at 12:32

Hakan Fıstık

16,800
14
110
131

answered Oct 19 '15 at 10:28

whizkid

431
4
4

6

To check the certificate expiry, go to the command line, navigate to where your certificate is, then enter `certutil -dump mycertificate.pfx` . Look at the last entry as the first ones are the CA, not your code signing certificate. – JsAndDotNet Jun 01 '17 at 11:08

nPcomp · Answer 5 · 2019-09-18T12:04:01.260

32

If you do not have to sign the app, right click on your project

Project Properties -> Signing -> uncheck "Sign the ClickOnce Manifest"

Also as this MS article suggests,

If you are using Visual Studio 2008 and are targeting .NET 3.5 and using automatic updates, you can just change the certificate and deploy a new version,

edited Sep 18 '19 at 12:04

answered Jan 17 '19 at 03:07

nPcomp

8,637
2
54
49

1

You can also click on create test certificate to carry on. thanks – MindRoasterMir Apr 26 '20 at 20:25

score 19 · Answer 6 · edited Jun 02 '17 at 08:47

19

In my case I have the wrong type of certificate that I am trying to associate.
I had "Server Authentication" rather than "Code signing".
You should be able to see this in Certificate snap in the Intended Purpose section.
After that, it just work fine.

edited Jun 02 '17 at 08:47

Hakan Fıstık

16,800
14
110
131

answered Oct 22 '14 at 15:51

maridob

651
6
22

2

Yes, that is, I was struggling for 2 days looking for this answer. – Hakan Fıstık Jun 02 '17 at 09:22
1

where do you change this option? – sinsedrix Jan 18 '21 at 10:54
New-SelfSignedCertificate -Type CodeSigning – Frank Myat Thu Nov 04 '22 at 02:14

score 16 · Answer 7 · edited Jun 01 '17 at 11:53

16

Got the same issue, turned out that the private key to the certificate had no permission.
To fix - open the certifacte management, find your certificate, right click -> Manage Private Keys and then in security on top be sure that your user is added and given permissions, that fixed it for me.

edited Jun 01 '17 at 11:53

Hakan Fıstık

16,800
14
110
131

answered Nov 21 '14 at 16:12

user3740240

199
1
4

score 15 · Answer 8 · answered Aug 20 '14 at 14:15

15

In case anyone else runs into this: My problem ended up being that I needed to run the command prompt as administrator before using the signtool.exe app. Then everything works wonderfully.

answered Aug 20 '14 at 14:15

Dave

897
8
8

15

Didn't help in my case. – bgplaya Oct 15 '14 at 17:06
1

I am running signtool from VS2015 as a script, and i was facing the same issue. I ran the VS2015 as administrator and the signtool was able to sign my file> – hamaney Jul 11 '18 at 00:40

score 15 · Answer 9 · answered Jan 21 '18 at 05:43

15

just uncheck the 'Sign the click once manifests' from the signing tab in project properties,it will remove the error and you can create a new one as from there.

answered Jan 21 '18 at 05:43

Sourav Sharma

277
3
13

noelicus · Answer 10 · 2021-06-01T14:54:37.490

12

I had this problem and I'm not entirely sure which step below made it work, but hope this helps somebody else...this is what I did:

Install the downloaded certificate (.crt) into certificates (I put it into “personal” store) - right click on .crt file and click Install Certificate.
Run certmgr.msc and export the certificate (found in whichever store you used in the 1st step) as a pfx file including private key and extended properties
Use the exported .pfx file when signing your project
Example signtool: signtool sign /f "c:\mycert.pfx" /p mypassword /d "description" /t http://timestamp.verisign.com/scripts/timstamp.dll $(TargetPath)
where the password is the same as provided during Export

edited Jun 01 '21 at 14:54

answered Feb 15 '18 at 14:54

noelicus

14,468
3
92
111

1

Thanks, this did the trick. I was using the `.crt` file that Comodo provided instead of installing the certificate and then export the `.pfx` file. – Joshua Pinter Jun 10 '18 at 18:43
1

Thank you so much! – Bruno Soares Apr 04 '19 at 11:36
I bet this would fix the problem for me but when I try to export the .PFX option is greyed out. I might have to request a new certificate with the option to export private keys enabled? – Josh P May 28 '21 at 18:29
Make sure you install the certificate to the `Current User` (certmgr) and not `local Computer` (certlm) stores or VS won't locate it. – Reahreic Mar 28 '23 at 17:23

score 10 · Answer 11 · answered May 23 '17 at 19:20

10

I solved this by using the /sm flag to specify to look in the machine store instead of the default, which is My (Local User) store. Also, it can help to turn on debug for signtool by using /debug.

answered May 23 '17 at 19:20

jle

9,316
5
48
67

score 6 · Answer 12 · edited Jun 02 '17 at 08:45

6

I'm having the same problem, reading some answers (posted here), I saw my certificate expired.

Just create a new one from my start project. Then at certificates manager deleted the expired certificate.

Now everything compiles fine.

edited Jun 02 '17 at 08:45

Hakan Fıstık

16,800
14
110
131

answered Aug 15 '16 at 22:16

Juan Pablo Gomez

5,203
11
55
101

score 6 · Answer 13 · answered Feb 12 '19 at 21:54

I had the same "After Private Key filter, 0 certs were left" message and spent too much of my life trying to figure out what the message meant.

The problem was that I had installed the certificate incorrectly in the Windows Certificate store so there was no private key associated with the code signing certificate.

What I should have done was this:

Using either Firefox or Internet Explorer, submit the request to the issuer. This generates a PRIVATE KEY which is stored silently by the browser (a dialog appears for a fraction of a second in Firefox). Note that other browsers may not work: your life is too short to find out if they do.
Submit the request, jump through the issuer's validation hoops and loops, sacrifice a goat, pray to the gods, submit a signed statement from your great grandparents, etc.
Download the certificate (.crt) and import it into the same browser. The browser now has both the private key and the certificate.
Export the certificate from the browser as a Personal Information Exchange (.p12) file. You will be asked to supply a password to protect this file.
Keep a backup copy of the .p12 file.
Run the Certificate Manager (certmgr.msc), right click on the Personal certificate store, select All Tasks/Import... and import the .p12 file into Windows. You will be asked for the password you used to protect the file. At this point, depending upon your security requirements, you can mark the key as exportable so you can restore a copy from the Windows store. You can also mark that a password is required before use if you want to break batch scripts.
Run signtool successfully, breathe a sigh of relief, and ponder how much of your life you have wasted due to bad error messages and poor or missing documentation.

score 5 · Answer 14 · answered Feb 05 '15 at 21:34

The criteria include account name (whose private key it is associated with), domain, company, expiration date, intended purposes, among other things.

There are many different possible reasons for this error to occur, some have been listed already. Here is another tip: When importing a certificate, be sure you work with the original file received from the certificate authority (CA), or else some of the properties might be lost.

Example: recently I tried to import a certificate exported from a different account on the same machine. The certificate became visible to my account but was not associated with my account, and as a result signtool refused to recognize it without explicitly providing the file name and a password. Which, when done as part of the build process and written out explicitly in a batch file or source file, may not be sufficiently secure. (Importing the original CA-issued certificate solved it.)

score 3 · Answer 15 · answered Oct 31 '16 at 06:26

3

My problem ended up being that I did not understand the signtool options. I had provided the /n option with something that did not match my certificate. When I removed that it stopped complaining.

answered Oct 31 '16 at 06:26

Silwing

330
2
11

score 2 · Answer 16 · answered Jun 15 '16 at 08:51

I have had this issue too, tried a lot. Used SDK as well as Visual Studio signing, but everywhere I got "No certificates were found that met all the given criteria".

Solution: Be aware that, if "after private key filter": '0 left' shows up with option signtool sign /debug..., the cause is your PC doesn't has the CA itself in the store. To solve this, install the CA first (in my case a .crt file), then run the sign again. It should work right now!

Signtool only can be used with a CA which is requested ánd owned by the same PC.

I had no problem using signtool with a CA that came from another PC. — bparker, Mar 24 '18 at 01:20

score 2 · Answer 17 · answered Apr 26 '17 at 13:59

I had a similar problem my computer name had change and the certificate had expired. I was able to resolve this issue by creating a new test certificate.

In Visual Studio, right click on project in solution explorer. Select properties. Select Signing in properties window. Click "Create Test Certificate....". Enter password information for test certificate and click ok.

score 2 · Answer 18 · answered Jul 04 '17 at 10:14

With /debug, when you get this message "After Private Key filter, 0 certs were left.", one reason could be that the pfx file doesn't have the private key. When you export the installed certificate to pfx file ensure to enable the check box to also include the private key.

score 1 · Answer 19 · edited Nov 19 '14 at 15:48

1

Go to project properties and uncheck all fields from the Firm before init the compilation

edited Nov 19 '14 at 15:48

fedorqui

275,237
103
548
598

answered Nov 19 '14 at 15:29

ionsofa

11
1

score 0 · Answer 20 · answered Feb 23 '22 at 16:11

The digicert Token I use, must be recognized as "Microsoft Usbccid-Smartcard-Leser(WUDF)".

In case not, I get this error message 'No certificates were found that met all given criteria ...'. That kept me searching in SignTool options and the properties of the certificates quite long with no effort at all. So I hope it helps someone :-)

score 0 · Answer 21 · answered Jun 08 '22 at 08:46

0

I got this error when using Git Bash. Using PowerShell succeeded. If it helps anyone.

answered Jun 08 '22 at 08:46

Hiroshiba

91
4

`signtool.exe sign //fd sha256 //f "key.pfx" "app.appx"` – Pedru Nov 17 '22 at 13:20

score 0 · Answer 22 · answered Jul 20 '23 at 12:02

0

For my case, it was because I was too greedy. :^)
The expiry date was set to 31.12.9999, which seemed to upset SignTool.
Changing it to 31.12.3000 made it work.

answered Jul 20 '23 at 12:02

kagmole

2,005
2
12
27

Signtool error: No certificates were found that met all given criteria with a Windows Store App?

22 Answers22

Linked