How do you append SHA1 signature after the SHA256 signature?

Question

I have a .cat file that is signed by MS and I would like to append the SHA1 signature to it. However, signtool fails using /as to append the SHA1 signature. Error 0x80070057. I often sign using SHA1 first and use /as on the SHA256 signature and that works fine. It doesn't seem to like the /as with SHA1. Is there a way to get signtool to do it, does an updated version do it (using version from 8.1), or is there another tool that will do it?

TIA!!

FYR: https://stackoverflow.com/questions/18542160/signtool-failing-to-dual-sign-sha2-and-sha1-with-timestamps — chg, Mar 05 '19 at 07:38

score 0 · Answer 1 · answered Mar 07 '19 at 17:04

The answer is you can't as of this time. SHA1 has to be first.

But it doesn't matter because attestation signing only flags the .CAT valid for Windows 10. Prior windows will complain so you need to create your own separate .CAT file using inf2cat indicating which OSes to support.

How do you append SHA1 signature after the SHA256 signature?

1 Answers1