Signing an .exe with a .cer file (what is the name of my certificate that signtool.exe requests?)

Question

I bought a certificate for my program.

The website I bought it from sent me a .cer file (43-some-really-long-name-9962812767788.cer). No additional files were sent, but I am almost 100% sure that I do not need anything else.

When I click on this .cer file, there is information such as:

• for: (my details)
• by: Certum Code Signing CA
• Expires: 2014-10-24

All this information seems beautiful.

I have my .exe file that I want to sign with it (for example, when a user runs it as an administrator in Windows, he will be able to see the certificate information).

I found that I can use the signtool.exe file for it, but it always returns an error in which a certificate that meets all the criteria was not found.

So, how to sign my program (add .cer to my .exe) using only the .cer file (and all the files that I can create from this .cer file)?

I have no experience in certification of certificates, .cer and all certificates, so please consider this during the response (I am a simple person ...;)

---

So far I have installed (I think I did it right) .cer in the repository of trusted root certificate authorities on your computer, according to the MSDN Blog :

• Start-> Run → MMC
• File → Add / Remove Sanp to ...
• In the Add or Remove Snap-in window, select Certificates and click Add>. Select "Computer Account" and click "Next."
• Select "Local Computer" and click "Finish."
• Open Trusted Root Certificate Authorities Owners in the left pane and click Certificates, as shown in Figure 7. Then, right-click in the right pane of the window and select All Tasks → Import.
• Import the .cer file you created and install it.

I really see my guest in the MMC:

However, I do not know how to use signtool.exe correctly. Command:

Signtool sing /v /t http://timestamp.verisign.com/scripts/timstamp.dll /n CER_NAME_HERE FileToSign.exe 

Failure because I do not know what "CER_NAME_HERE" is for my certificate.

Answer 1

From your example, you are not actually specifying a certificate file.

First, you need to create a pfx file containing the certificate and any CA signing certificates, which are then transferred with the /f option:

 signtool.exe sign /f "blah.pfx" /t http://timestamp.comodoca.com/authenticode "filetosign.exe" 

The /n option is used only to select a specific certificate from the certificate store.

Answer 2

I have not seen a clear short answer, so I will add this.

For Certum, when you submit a certificate request, there is an installation option. Use this to install on your computer. Then you can go to the certificate store of your browser, select a certificate and select export. From there you can choose to export the private key, which will be in pfx format.

Hope this helps someone, ~ Techdude.

Answer 3

Saving a certificate to a certificate store is the right approach. The idea of ​​using a .pfx file directly invites you to steal a key. I am sure that the same people who provided such an answer also save a password that protects the private key that is open in some kind of batch file, for convenience. Regardless, I urge everyone to use certificate stores, why they were created in the first place.

You just need to import the .pfx with the private key into the Personal repository. Mark the private key as non-exportable for added security. You can then call signtool.exe using the /n switch and the value of the Issued To field. Password is no longer required. If you used machine scope , not user scope , you will also need to enable the /sm switch.

 signtool.exe sign /a /n "<Issued_To>" /t "<TimeStamp_Server>" <File_Name> 

Answer 4

I had the same problem and fixed it using p12 instead of the pfx file type. I created a p12 file using Firefox Certificate Manager with Comodo user.crt. Command line:

signtool sign / f "C: \ Test.p12" / p password1 / t http://timestamp.comodoca.com/authenticode / v "C: \ Test.msi"