Add intermediate certificates to signatures in signtool

1

I'm trying to sign an executable using Microsoft's signtool.exe
The private key lives in an HSM and can not be taken out. So, i had to get the "public" part of the certificate in a .cer file and used below command to sign

signtool.exe sign /v /f .\SigningCert.pem /csp "HSM Key Storage Provider" /k "KEYID" /tr http://timestamp.digicert.com /fd sha256 /td sha256 .\App.exe

Since the machine i used for signing did not have the intermediate certificate added to Windows trust store, the signed executable could not be verified.

SignTool Error: WinVerifyTrust returned error: 0x800B010A
        A certificate chain could not be built to a trusted root authority.

That being said, I used below command to add the intermediate certificate using /ac switch

signtool.exe sign /v /f .\SigningCert.pem /csp "HSM Key Storage Provider" /k "KEYID" /ac .\Intermediate.pem /tr http://timestamp.digicert.com /fd sha256 /td sha256 .\App.exe

The executable could be verified properly. So far so good.

Now, if my certificate chain has more than one intermediate certs, how could i add them to signatures?

Example chain:

Leaf Cert -> Intermediate 1 -> Intermediate 2 -> Root Cert

I tried merging all the intermediate certs into a single pem file and using it with /ac switch. Apparently, Signtool takes only the first certificate from the pem file and ignores the rest.

Also, If i want to add cross certificates from Microsoft apart from my intermediate certificates, how would i add them?

As far as i read, I can put all the certs into a pfx file and use it with signtool. But, as i mentioned, i don't have access to the private key. I do not think building a pfx file is an option for me.

windows
azure
certificate
code-signing
signtool
asked on Stack Overflow Apr 15, 2020 by GAR

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0