Signtool with a certificate stored on the local computer

Question

I can not get signtool to find my certificate. The pfx file works for signing, I checked this by specifying the pfx file directly with the password. But due to other people having access to the code repository, I really don't want to store the certificate + password there.

This is why I installed pfx (from symantec) on the build server (as a local computer, not as a user) in "trusted root certification authorities". This is because Jenkins starts with a local system account.

This is what I'm trying at the moment:

signtool sign /v /sm /s Root /n <thename> /t http://timestamp.digicert.com <thefile> 

/ sm / s Root - this should tell signtool to switch to the local machine repository, right? and Root should specify "trusted root certificate authorities"?

/ n - here I use the value "Issued" from the certificate, which is the name of the company.

The following error meets me:

 "SignTool Error: No certificates were found that met all the given criteria." 

Today I made so many links trying to figure out what I'm doing wrong. I checked using mmc with the certificate snap-in on the local computer, and the certificate went to "trusted root certificate authorities".

Answer 1

Try the following command:

 signtool sign /v /sm /s My /n <thename> /t http://timestamp.digicert.com <thefile> 

You used the /sm option well, but when you added /s Root , you said that signtool should look in the store , but in Root authority . You can also skip the /s option since /s My is the default.

See the signtool documentation for more information.