"Error: SignerSign() failed." (-2147023673/0x800704c7)

While using signtool for code signing on our buildserver jenkins shows the following error message:

Done Adding Additional Store
Error information: "Error: SignerSign() failed." (-2147023673/0x800704c7)
SignTool Error: An unexpected internal error has occurred.

We use an EV code sign certificate on a USB token. All tools are the latest ones available actually.

Any ideas?

It is not a problem at all using the same build task and running it manually on the same machine (as the user mentioned below) that jenkins is running on, and the same environment / directory.

The Jenkins service runs on a Windows 10 pro VM as a simple user with admin rights (not as Local System).

For more details see this excerpt from the Jenkins log:

  Signiere FlinkySchule.FormularEditor.exe:
  Verbindung zu Token auf- bzw. abbauen
  ***** code signing *****
  Aktueller Pfad des signtool:
  c:\JW\FS\Production\Deployment\Tools\signtool\kits
  Zu signierende Datei:
  c:\JW\FS\Production\Application\Assemblies\FlinkySchule.FormularEditor\bin\Release\\FlinkySchule.FormularEditor.exe
  The following certificate was selected:
      Issued to: Dirk W.

      Issued by: GlobalSign CodeSigning CA - SHA256 - G3

      Expires:   Fri Apr 03 15:58:51 2020

      SHA1 hash: 4187Cxyxyxyxyxyxyxyxyxyxyx7978C4


  Done Adding Additional Store
EXEC : error information: "Error: SignerSign() failed." (2147023673/0x800704c7) [c:\JW\FS\Production\Application\Assemblies\FlinkySchule.FormularEditor\FlinkySchule.FormularEditor.csproj]
EXEC : SignTool error : An unexpected internal error has occurred. [c:\JW\FS\Production\Application\Assemblies\FlinkySchule.FormularEditor\FlinkySchule.FormularEditor.csproj]

One issue was the over all path length: Even in the year 2017 you will run into the 260 characters path length restriction. Annoying! But we solved this and the error still occurs sometimes.

I ran into this problem as well. I was able to duplicate error outside of Jenkins by running Signtool.exe, but when the prompt appeared for the token password, click cancel. You'll get the same error.

I have a C program which watches for the Symantec prompt and automatically enters the toke password. But Jenkins clearly wasn't running Signtool.exe in the same context as my password helper program. So I then edited my program which runs Signtool.exe to run the password helper program as well. It was still no good. Then I realized that maybe the problem how Jenkins is being run on the node. I had the Jenkins node running a service. Once I stopped the service, and connected by running the java command directly on the command line, it worked!

So now I know, if I'm going to run signtool on a Windows node, make sure the node is connected by running on the command line (via scheduled task), not a service. This changes the context Jenkins is run under which allows SignTool and the Token Prompt to play nice.