Sign Microsoft Files | Keyfactor Docs

Signum can be used with Microsoft SignTool to sign files in Windows, such as .dll, .cab, .appx, .exe, .msi, .msix, and .ps1.

Prerequisites

Signum Windows Agent installed.
SignTool installed. For instructions on how to install SignTool and a complete list of commands, see Microsoft SignTool Win32 apps documentation

Step 1 - Set Certificate Access

Ensure that you are logged into the Signum Agent with a valid user that has access to a certificate by being assigned to a policy in Signum. Once logged in, you can view certificates in the Users certificate store or the Local Machine certificate store in Windows.

The certificates can also be viewed in the shell, with the following PowerShell examples. These will return all certificates with a Code Signing EKU.

Option 1: Using the Local Machine Store

Use the path to your local machine store:

Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {
    $_.EnhancedKeyUsageList.Contains([Microsoft.PowerShell.Commands.EnhancedKeyUsageRepresentation]::new('Code Signing','1.3.6.1.5.5.7.3.3'))
} | ForEach-Object {
    [PSCustomObject]@{
        CN = ($_.Subject -split ',')[0] -replace '^CN=', ''
        Thumbprint = $_.Thumbprint
    }
} | ForEach-Object {
    Write-Output "CN: $($_.CN), Thumbprint: $($_.Thumbprint)"
}

Option 2: Using the Users Store

Use the path to your current user store:

Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object {
    $_.EnhancedKeyUsageList.Contains([Microsoft.PowerShell.Commands.EnhancedKeyUsageRepresentation]::new('Code Signing','1.3.6.1.5.5.7.3.3'))
} | ForEach-Object {
    [PSCustomObject]@{
        CN = ($_.Subject -split ',')[0] -replace '^CN=', ''
        Thumbprint = $_.Thumbprint
    }
} | ForEach-Object {
    Write-Output "CN: $($_.CN), Thumbprint: $($_.Thumbprint)"
}

Example Output

CN: Signum-RSA-2048 New, Thumbprint: F78AE7871FEF1D0CF3EFFB58E9CC85F261438D2B
CN: Signum-RSA-4096, Thumbprint: 3AB5BFB91DFBB46CF765D5BEE51429618C4857DD
CN: Signum-RSA-3072, Thumbprint: 170570A1D56FBB5A4CC780B69ACAEF94010D5DAA

Step 2 - Sign with Certificate

Use the certificate to sign your file in one of the following ways:

Example using the Certificate Thumbprint

Specify the certificate algorithm for /fd and the certificate thumbprint for the /sha1 value:

signtool.exe sign /fd SHA256 /sha1 CE1EB74EC5A8CC93EABA4066D15DDCBCEEF28EC2  example.dll

Example including a Timestamp Authority

In general, it is best to always include a timestamp on signatures to ensure validity of the signature past the certificates expiration.

Alongside the certificate algorithm and thumbprint, provide your TSA for the /t value:

signtool.exe sign /fd SHA256 /sha1 CE1EB74EC5A8CC93EABA4066D15DDCBCEEF28EC2 /t Replace-With-TSA-URL  example.dll

Example using the Certificate CN

Using the CN has the advantage that if the certificate is ever renewed existing scripts should be able to stay the same.

Provide the name of the subject of the signing certificate for /n:

signtool.exe sign /fd SHA256 /n "Code Signing"  example.dll

Example using the Legacy Windows Agent in Server Mode

In Server Mode, the legacy Windows Agent places certificates in the Local Machine certificate store in Windows unless the -targetStore has been set to the users personal certificate store. To use the Local Machine store, use the /sm flag:

signtool.exe sign /fd SHA256 /sm /sha1 CE1EB74EC5A8CC93EABA4066D15DDCBCEEF28EC2  example.dll

If the signing is successful, the signing command returns:

Done Adding Additional Store
Successfully signed: example.dll

Step 3 - Verify the Signature

Verify the file signature using the following command:

signtool.exe verify /pa /v .\example.dll

The command returns the following:

Verifying: .\example.dll

Signature Index: 0 (Primary Signature)
Hash of file (sha256): B410D82594A7DD698C766FD5D9D6A417B1147DD91FE0BE7DED3C8E087CFACBEE

Signing Certificate Chain:
    Issued to: Keyfactor Demo CA
    Issued by: Keyfactor Demo CA
    Expires:   Fri Jul 23 15:28:37 2032
    SHA1 hash: B2948658CE2F3133B82BE32A35A84ED7F54B5A33

        Issued to: Keyfactor Demo Working
        Issued by: Keyfactor Demo CA
        Expires:   Thu Jul 24 16:36:13 2031
        SHA1 hash: D50E48B6F937AA6DE6F7DADC8DE3D3923CBB306B

            Issued to: Keyfactor Demo Code Signing
            Issued by: Keyfactor Demo Working
            Expires:   Thu Jul 24 16:36:13 2031
            SHA1 hash: BED3F3DD7C9FE484454408541D857F4F6FEEFC9E

                Issued to: Code Signing
                Issued by: Keyfactor Demo Code Signing
                Expires:   Sat Aug 03 11:35:34 2024
                SHA1 hash: CE1EB74EC5A8CC93EABA4066D15DDCBCEEF28EC2

File is not timestamped.
Successfully verified: .\example.dll

Number of files successfully Verified: 1
Number of warnings: 0
Number of errors: 0