why signtool remove certificate

Question

I am using signTool. I am signing certificate like this:

 signtool sign /debug /s My /n "%signer%" /tr http://timestamp.digicert.com /td sha256 /fd sha256 /a "My.exe"

It is signed with the new certificate "signer", but all others are removed. Why it is like this and how I would keep old ones.

Answer 1

Because you did not specify in your command line parameters that signtool.exe should append the signature if other signatures already exist:

/as         Append this signature. If no primary signature is present, this
            signature will be made the primary signature instead.