{"id":287,"date":"2008-09-12T13:24:12","date_gmt":"2008-09-12T21:24:12","guid":{"rendered":"http:\/\/www.curlybrace.com\/words\/?p=287"},"modified":"2010-12-15T20:05:49","modified_gmt":"2010-12-16T04:05:49","slug":"using-certificates-and-signtool","status":"publish","type":"post","link":"https:\/\/www.curlybrace.com\/words\/2008\/09\/using-certificates-and-signtool\/","title":{"rendered":"Using Certificates and Signtool"},"content":{"rendered":"<h2>Obtain a Software Publisher Certificate<\/h2>\n<p>Your Certificate Authority will supply one of the following:<\/p>\n<ol>\n<li \/>a <a href=\"http:\/\/en.wikipedia.org\/wiki\/PFX\">Personal Information Exchange<\/a> (.pfx) file\n<li \/>a <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/aa906334.aspx\">Software Publisher Certificate<\/a> (.spc), and a <a href=\"http:\/\/www.drh-consultancy.demon.co.uk\/pvk.html\">Private Key<\/a> (.pvk) file\n<li \/>a <a href=\"http:\/\/en.wikipedia.org\/wiki\/Canonical_Encoding_Rules\">CER-encoded<\/a> <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/aa906334.aspx\">X.509 Certificate<\/a> (.cer), and a Private Key (.pvk) file\n<\/ol>\n<p>For the second and third case, these file must be converted to a <a href=\"http:\/\/www.wireshark.org\/docs\/dfref\/p\/pkcs12.html\">Personal Information Exchange<\/a> (.pfx), using the <a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/ff550672(VS.85).aspx\">Pvk2Pfx.exe<\/a> tool.<\/p>\n<h3>Convert SPC or CER to Personal Information Exchange (.pfx)<\/h3>\n<p>Syntax for .spc conversion:<\/p>\n<blockquote>\n<pre class=\"DOS\">pvk2pfx -pvk filename.pvk -pi password -spc filename.spc -pfx output.pfx<\/pre>\n<\/blockquote>\n<p>The syntax is identical for .cer conversion:<\/p>\n<blockquote>\n<pre class=\"DOS\">pvk2pfx -pvk filename.pvk -pi password -spc filename.cer -pfx output.pfx<\/pre>\n<\/blockquote>\n<h2>Sign the Executable<\/h2>\n<p><tt>Signtool.exe<\/tt> can be used to sign executables (.exe) and Dynamic Link Libraries (.DLL).<\/p>\n<h3>Basic Signature<\/h3>\n<blockquote>\n<pre class=\"DOS\">signtool.exe sign \/v \/f filename.pvk \/p password executable<\/pre>\n<\/blockquote>\n<h3>Signature With Timestamp<\/h3>\n<blockquote>\n<pre class=\"DOS\">signtool.exe sign \/v \/f filename.pvk \/p password \/t timeurl executable<\/pre>\n<\/blockquote>\n<p>Where <tt>timeurl<\/tt> is the URL of your Certificate Authority&#8217;s timestamp server (e.g. http:\/\/timestamp.verisign.com\/scripts\/timestamp.dll for VeriSign)<\/p>\n<h3>Signature Verification<\/h3>\n<blockquote>\n<pre class=\"DOS\">signtool verify \/pa executable<\/pre>\n<\/blockquote>\n<p><tt>\/pa<\/tt> indicates that the &#8220;Default Authenticode&#8221; verification policy is used.  Omitting the switch will cause the verification to fail, which does not necessarily mean that a given file isn&#8217;t Authenticode signed.<\/p>\n<h2>Resources<\/h2>\n<ul>\n<li \/><a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/aa906334.aspx\">Windows Driver Kit: Device Installation, Software Publisher Certificate<\/a> (MSDN)\n<li \/><a href=\"http:\/\/en.wikipedia.org\/wiki\/PKCS12\">PKCS12<\/a> is the successor to PFX.\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Obtain a Software Publisher Certificate Your Certificate Authority will supply one of the following: a Personal Information Exchange (.pfx) file a Software Publisher Certificate (.spc), and a Private Key (.pvk) file a CER-encoded X.509 Certificate (.cer), and a Private Key &hellip; <a href=\"https:\/\/www.curlybrace.com\/words\/2008\/09\/using-certificates-and-signtool\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[181,15],"tags":[],"class_list":["post-287","post","type-post","status-publish","format-standard","hentry","category-cryptography","category-technology"],"_links":{"self":[{"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/posts\/287","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/comments?post=287"}],"version-history":[{"count":18,"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/posts\/287\/revisions"}],"predecessor-version":[{"id":1431,"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/posts\/287\/revisions\/1431"}],"wp:attachment":[{"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/media?parent=287"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/categories?post=287"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/tags?post=287"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}