We have a file, say, scup.jpg, that we want to sign and (later) verify with signtool.
For embedded content we execute
signtool.exe sign /p7 .\ /p7ce embedded /p7co 1.2.840.113549.1.7.2 /a /f .\pfx.p12 /p "somepass" .\scup.jpg
and it produces a file named scup.jpg.p7 that is verifiable with the folowing command:
signtool.exe verify /p7 scup2.jpg.p7
but what we need is not an embedded data, but rather a detached signature, so we change the signing command to
signtool.exe sign /p7 .\ /p7ce DetachedSignedData /p7co 1.2.840.113549.1.7.2 /a /f .\pfx.p12 /p "somepass" .\scup.jpg
and produce a detached signature file also named scup2.jpg.p7, but no matter what command options we try to verify the signature, signtool gives us errors, like tis one:
SignTool Error: CryptVerifyMessageSignature returned error: 0x8009310B
ASN1 bad tag value met.
SignTool Error: File not valid: scup.jpg.p7
Number of errors: 1
What do we do wrong and is it at all possible to verify a detached signature with signtool? I know I could use openssl or progarmming tools/API, but for the moment I need clarity regarding signtool itelf.
User contributions licensed under CC BY-SA 3.0