Code Signing

From SkyWiki

How to create a private self-signed software certificate in MS Windows and use it to sign a binary file.

# setup input variables

set NAME=CN=SURNAME NAME,O=SURNAME NAME,E=EMAIL@XYZ.COM
set CER=C:\PATH\NAME.cer
set PVK=C:\PATH\NAME.pvk
set SPC=C:\PATH\NAME.spc
set PFX=C:\PATH\NAME.pfx
set TimeURL=http://timestamp.verisign.com/scripts/timstamp.dll


# create certificate files

makecert -r -n "%NAME%" -sv "%PVK%" %CER%
cert2spc %CER% %SPC%
pvk2pfx -pvk %PVK% -spc %SPC% -pfx %PFX% -f


# sign the executable file "BINARY.exe" (or ZIP file or what ever)

signtool sign -f %PFX% -t "%TimeURL%" -v "BINARY.exe"


# display and verify the signature information

signtool.exe verify /v /a "%File%"