SignTool Error: Access Denied

Question

I'm trying to authenticate to sign a .NET application with a new code signing certificate on Windows Server 2008 R2 x64 with VS2010 installed, but SignTool continues to respond to the Access request:

SignTool.exe sign /v /a /sha1 <thumbprint> MyApplication.exe The following certificate was selected: Issued to: <redacted> Issued by: VeriSign Class 3 Code Signing 2010 CA Expires: Thu Jun 28 01:59:59 2012 SHA1 hash: <thumbprint> Done Adding Additional Store SignTool Error: Access is denied. SignTool Error: An error occurred while attempting to sign: MyApplication.exe Number of files successfully Signed: 0 Number of warnings: 0 Number of errors: 1 

The certificate is installed in the user's personal store, and the user is a member of the local administrators group. I also tried to sign up using a .pfx file, but kept getting the same error. Disabling the UAC prompt also showed no effect.

Any ideas?

Answer 1

The reason was that the secret key protection was enabled, but if the command prompt is not specified on the command line, the corresponding "Application is requesting access to the protected element". tooltip is not displayed.

To fix this problem, I had to remove the certificate and key, and then reimport from the .pfx file, this time without choosing strong secret key protection.

Answer 2

I also used this pb to use signtool.exe with windows 8. To solve the problem, you should run cmd.exe directly from c: \ windows \ system32 \ cmd.exe by clicking "Run as administrator".

Answer 3

I had the same problem, but in my case I tried to start from a Windows service running under the LocalSystem account. Changing it to a regular account solved the problem.

Answer 4

For me, this decided that my exe file was read-only. Removing write protection allowed SignTool to do its job without further problems.

(Courtesy: eselk comment on SignTool Error: access denied )