Windows (SignTool)
SignTool (Windows SDK) creates Authenticode signatures. With a DigiCert USB eToken, SafeNet exposes the certificate to Windows so SignTool can use it.
Prerequisites: certificate installed on the eToken, SafeNet running, token inserted. You will be prompted for the eToken Password.
Install SignTool
SignTool ships with the Windows SDK. After install, signtool.exe is under a path like:
C:\Program Files (x86)\Windows Kits\10\bin\<version>\x64\signtool.exe
Add that directory to PATH or call it with a full path.
Sign with the eToken
Insert the token. A typical command:
signtool sign /fd SHA256 /td SHA256 /tr http://timestamp.digicert.com /a /v yourApp.exe
| Flag | Meaning |
|---|---|
/fd SHA256 |
File digest algorithm |
/td SHA256 |
Timestamp digest algorithm |
/tr http://timestamp.digicert.com |
RFC 3161 timestamp URL |
/a |
Automatically select a suitable code signing cert |
/v |
Verbose |
To pick a specific subject (organization name on the cert):
signtool sign /fd SHA256 /td SHA256 /tr http://timestamp.digicert.com /n "Your Organization Name" /v yourApp.exe
SignTool should show the SafeNet PIN dialog. If it does not see the cert, confirm SafeNet shows the token and that you are signed in with the eToken Password.
Verify
signtool verify /pa /v yourApp.exe
/pa uses the default Authenticode verification policy.
Azure Key Vault
SignTool does not call Key Vault directly. Use AzureSignTool (or another Key Vault–aware signer) as shown in Azure Key Vault.
KeyLocker
For DigiCert KeyLocker, use DigiCert’s signing clients rather than SignTool-on-token. See DigiCert KeyLocker and DigiCert KeyLocker documentation.