Windows code-signing in 5 minutes or less

Note: this might be unsafe - only use this as a quick reference if you know what you’re doing.

Create the self-signed certificate #

Config #

Save this into ssl.cfg or similar.

[req]

distinguished_name = req_distinguished_name
req_extensions = default_req_extensions

[req_distinguished_name]
# empty

[default_req_extensions]

basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature, nonRepudiation
extendedKeyUsage = critical, codeSigning, msCodeInd, msCodeCom

Make the certificate and private key #

ssl.cfg refers to the file created above. Adjust the subject as necessary.

openssl req -x509 -newkey rsa -keyout testkey.pem -nodes -days 3650 -sha256 -config ssl.cfg -subj "//CN=Demo code-signing certificate" -out testcert.pem

You can get OpenSSL in either Git for Windows or Cmder.

Create a PFX and import it into your personal certificate store #

openssl pkcs12 -export -inkey testkey.pem -in testcert.pem -out testpfx.pfx -nodes -passout pass:

Open mmc.exe, add the Certificates snap-in and select My user account, then right-click on the Personal trust store and Import.

Import the certificate into the system’s trust store #

User-specific #

In the previously opened window, right-click on Trusted Root Certification Authorities and import the certificate (and not the PFX which includes the private key).

Computer-specific #

Remove the user-specific certificates snap-in and add a Computer account certificates snap-in, then do as outlined above to import the certificate.

Sign some code #

"C:\Program Files\Microsoft SDKs\Windows\v7.1\Bin\signtool.exe" sign mybinary.exe

You can get signtool from Microsoft’s Windows 7 SDK.

 
1
Kudos
 
1
Kudos

Now read this

Blockchains for non-cryptocurrency applications don’t make sense

There’s a lot of hype going around about blockchains and pretty much everyone is attempting to put something (including physical assets) on the blockchain. However, most of these use-cases don’t make sense to me and I’d like to explain... Continue →