I would appreciate if someone could teach how to sign a file using Microsoft signtool as below,
To have one certificate signed by the first authority; and one certificate signed by the second authority - both are having the same public key / fingerprint and subject line, then to sign a file to have one signature with these 2 certificates,
Your prompt reply is appreciated,
Many thanks in advance.
Related
As I can see, in Windows, the Digital Signature tab of an EXE file will show the Company Name, City Name, and Country Name of the company.
Is the user able to find the detailed address of the company from the signature? The situation is the same for OV and EV code signings?
Thank you.
Information appearing on the Digital Signature tab come from the 'Subject' field of the certificate.
This information is provided by the company when signing keys are generated.
Then, those keys are used to generate a Certificate signing request (CSR) who contains this information + public key.
This is this CSR who is transmitted to the certificate authority.
The certificate authority will then sign digitally the certificate with his proper key, after validation of information present on the CSR. It will not add any further information about the company, only validate and sign. The validation process of the company by the authority will be different for OV or EV, but information present on the certificate stays those provided by the company on the CSR.
The detailed address of the company will appear only if it was provided when signing keys were generated.
This is not typical information required on a certificate, but the company can choose to add personalized information on the Subject field.
I am not aware of any certificate authority who require the detailed address on CSR.
I don't believe so as it would not be very secure to display the company's detailed information. This could lead to someone breaking in or harassing workers where Microsoft could be blamed as they let the company's address go public.
Data about an exe file made with visual studio is created like this inside the AssemblyInfo.cs (in C# projects) in the properties. This is all the data that can be found if I'm correct. Every application made in visual studio will have something like this, I'm not sure about C++ projects, but it should be something around the lines like this.
I have 2 code signing certificates, for both CSR is created same way, also import and export is done same way. The only difference that I see is that one of certificates Common name contains Quotes, and the other doesn't.
e.g.
some cert and
some "cert"
CSR creation
Request format PKCS #10
disabled "Strong private key encryption"
Entered Common name, Organization, Locality, State, Country
2048 bytes for private key
set private key exportable
Import
place all certificates in Personal store
Export
Include all certificates if possible
Enable certificate privacy
encryption algorithm TripleDES-SHA1
Misleading thing is that this Common name value is NOT taken from the value I entered when I created CSR request
I am using those certificates to sign Winforms applications in Visual Studio. Certificate without Quotes in common name is working correctly (i.e. when I install application user is not getting security warning about unknown publisher), but when I install application which is signed with the other Code signing certificate (with Quotes in Common name) - it does not recognize Publisher. No error when published my application. When I take a look at setup.exe properties in Windows Explorer I see a Digital signatures tab which contains row for my certificate.
I tried to sign files with signtool and then verify - it said that certificate is valid.
I tried to get help from godaddy.com where I bought my certificate, they said that it should work with quotes, too, but didn't offer help to solve the issue. Rekey also didn't help.
I see that there are some suggestions to use Pre Publish, Post Build tasks, but I am not using those for my first certificate which is working.
So, is anyone here using code signing certificate for Winforms application with common name having quotes in it? Or maybe anyone knows about this problem and how to solve it?
Had to revoke (common name which is entered when creating CSR is not taken into account, so rekeying is not enough!) my code signing certificate and create from start without quotes/brackets in company name.
So this means, you will have to wait again for few days, because verification process is made from start again. When you will be contacted by issuer, they will verify / ask you about company name - make sure that they do not include quotes/brackets.
Revoking means that you will basically have to buy your certificate once more, because after you revoke it (at least in godaddy case) in your account you don't have options to create it again. So, you have to contact support (use call center and not chat ;)
I am trying to connect to a secure webservice from Twilio. Twilio's documentation states they only approve connecting to secure sites issued by CA's approved by Mozilla. The link (https://mozillacaprogram.secure.force.com/CA/IncludedCACertificateReport) of the approved CA's listed in in Twilio is broken.
But after a little bit of googling it appears Mozilla recognizes "The Internet Security Research Group (ISRG)" as a valid CA.
My certificate is signed by "Let's Encrypt Authority" formally known as "The Internet Security Research Group (ISRG)"
I have never had a browser issue using this authority and all the on-line certificate validation sites I have tested indicate there is no problem with my certificate.
The Twilio error I am receiving is
Error - 11237 Certificate Invalid - Could not find path to certificate
My guess is Twilio does not recognize this CA as a legit signing authority which is unfortunate because they have over 36 Million certificates active.
Anybody using this authority?
Any suggestions on a proxy?
Could this be an issue on Twilio's side?
Do you by any chance use the "cert.pem" file as your certificate? If so, use "fullchain.pem" instead.
Let's Encrypt's certbot generates 4 files, https://certbot.eff.org/docs/using.html#where-certs.
Of those, cert.pem contains only your server certificate, but not the full chain up to the root CA. And according to Twilio's docs, https://www.twilio.com/docs/api/errors/11237, you need the certificate file with the full chain, which would be fullchain.pem
we developed an app for WP8 and wanted to distribute it internally via a download URL to the XAP file. Steps we have taken so far:
Use Makecert.exe to generate a self signed XXX.cer with a XXX.pvk (with no password)
Used Pvk2Pfx.exe to create a pfx file which includes the private key (with a password)
Used XapSignTool.exe to sign our XXX_Release.xap
We also deployed the XXX.cer to the phone device but we still get the error "Can't install company app".
After that we tried to generate a Application enrollment token (AET) with AetGenerator.exe (not 100% sure if we do need this) from out XXX.pfx which exits with an error:
Unknown error while generating AET startIndex cannot be larger than
length of string. Parameter name: startIndex
Any ideas what we are doing wrong or suggestions what would be the way to distribute an app like that? Is it only possible if we have obtained a certificate from Symantec?
Thanks!
PS: I just browsed throught the MS Documentation and for the PFX parameter of the AETGenerator it states:
Required. The name of the PFX file generated from the enterprise mobile code-signing certificate provided by Symantec.
So most probably it seems that a Symantec $299/year certificate is required. Would this be the correct assumption?
It was indeed as it seemed. You can sign you code with any self signed pfx generated after the latest documentation on the pfx tool.
It is not possible to deploy an App without a company account. This involves paying the $299 and going through the certification process by Symantec.
I'm trying to create a test certificate and sign a .MSI file I have created. I need to get the test version working with a signed .MSI before we can purchase a real security certificate.
I have performed the following steps to sign my .MSI file. Everything completes successfully and it displays a message that 1 file was successfully signed after the last step.
makecert.exe -sv c:\Test\mykey.pvk -n "CN=WTS" c:\Test\myCert.cer
cert2spc.exe c:\Test\mycert.cer c:\Test\mycert.spc
pvk2pfx -pvk c:\Test\mykey.pvk -pi password -spc c:\Test\mycert.spc -pfx c:\Test\mycert.pfx -po password
signTool sign /f c:\Test\mycert.pfx /p password /v c:\Test\test.msi
After performing these steps, I run the .MSI file (the date modified for the .MSI does change to match the time the signTool step was ran). The warning message saying this .MSI is from an unknown publisher is still displayed as is "Publisher: Unknown".
Did I miss a step or something? Everything seems to work correctly, I never see any errors, but my file doesn't appear to be signed.
Your file is signed. Windows declares the publisher as unknown because it does not trust the publisher identification in the signature.
Remember that in the world of digital signatures, you always need to verify at least two things at once or the whole exercise is meaningless. You must check the name on the signature, and you also need to find a trust link from something that you already trust (for example, a certification authority, or a certificate manually added as trusted) up to the signature that you are checking. Only then it makes sense to trust the name on the signature, and perhaps to display it to the operating system user.
In your web browser, go to Tools / Internet Options / Content / Publishers / Certificates and add your test certificate to Trusted Publishers.
(Another browser might have the same function under Settings / Show Advanced Settings / HTTPS/SSL / Manage Certificates.)
And retry. It won't work but I don't really know why and it is an instructive game.
It is not clear whether there is a way on Windows to establish a chain of trust if your certificate is home-made and there is no certification authority to back it. This source says:
If you use a test (self-created) certificate, the installation dialogs
will display an "Unknown publisher" message. For applications deployed
internally in an organization, this is an acceptable practice."
You can however create your own certification authority as described here and add the CA certificate under the Trusted Root Certification Authorities. By doing this you are basically letting any certificate issued by that CA sign anything and be trusted by Windows.
I had the same problem and found that Microsoft is no longer trust certificates with "sha 1" algorithm.
I solved the problem by asking my CA to replace the cerificate.
This can also happen if you have not used the switch "/d" to specify a description when signing the package. See more details under "sign Command Options" on this page:
http://msdn.microsoft.com/en-us/library/8s9b9yaz.aspx