5

I have been using SHA1 signing for many years, but from 2016, Windows is forcing developers to use SHA256.

Windows Enforcement of Authenticode Code Signing and Timestamping

By using Windows 7 SDK signtool the functions to sign SHA-256 is "unknown commands", so this signtool is obsolete as a signtool and shouldn't be used any more.

To sign with SHA256 I downloaded the Windows 8.1 SDK to get signtool.exe which got the new functions(/fd and others). The BAT file and signtool works on Windows 8 and 10, so I know it works, but crashes on Windows 7 when it tries to timestamp the file.

Signing fails

I use a bat file to sign files, which looks like this(I edited the BAT file so it doesn't show variables, full paths, company name and passwords):

Path\signtool.exe sign /f "Path\Certificate.p12" /fd sha256 /p *password* /du "URL" /tr "timestampServer?td=sha256" /td sha256 /d "Product name" "Filename"

I guess, I don't have the proper SDK to support some of the functions, but I can't find any info on the internet on how to setup this on Windows 7. I tried to install MS Visual C++ 2015 Redistributable (x64), but still didn't solve the problem.

3

I finally found a solution for double-signing files in Windows 7.

The trick is to use the Window 8 SDK (not 8.1 or 10)! I used this download: https://developer.microsoft.com/windows/downloads/windows-8-sdk

In Windows 7 x64 make sure to point to the x64 binary (...\8.0\bin\x64\signtool.exe)

As a bonus here's a comfortable batch script I made. Simply save it as doublesign.bat and drag a file you want to be signed on that bat-file.

@ECHO OFF

set signtool="C:\path to signtool\signtool.exe"
set certfile="C:\path to certificate\cert.p12"
set certpass="Password"
set company="Optional"

echo Signing with SHA-1
%signtool% sign /f %certfile% /p %certpass% /t http://timestamp.comodoca.com/authenticode %1
timeout /T 3
echo. & echo Signing with SHA-256
%signtool% sign /f %certfile% /p %certpass% /as /fd sha256 /tr http://timestamp.comodoca.com/rfc3161 /td sha256 %1

@PAUSE
  • I haven't tested this as I moved onto windows 10 not long ago. But your answer is the best at the moment, so I have marked this as the correct answer. – Frank Jelstrup Jul 3 '16 at 15:46
1

The issue is actually way simpler.

The problem is with the time stamp server.

Instead of using signtool.exe with this

/t http://timestamp.comodoca.com 

You need to use it like this for SHA1

/tr http://timestamp.comodoca.com /td sha1

And for SHA256

/tr http://timestamp.comodoca.com/?td=sha256 /td sha256
  • Your commands still cause signtool to crash for me; I guess you are using the signtool from the Windows 8 SDK – Cocowalla Aug 8 '17 at 20:23
0

Seems I'm no good at reading, also I'm answering my own question as others could find it hard to find, just like me.

Windows doesn't support the signtool.exe on Windows 7 any more, so that is why old/obsolete functions like SHA-1 signing is still working, but SHA-256 time stamping is a problem. I found this on MSDN:

Quote from MSDN: Note You can only use SignTool to sign your Windows Store app packages on Windows 8 and later or Windows Server 2012 and later. You can't use SignTool to sign app packages on down level operating systems such as Windows 7 or Windows Server 2008 R2.

If you want to read the whole thing then look here:

How to sign an app package using SignTool

  • This is only about appx packages, though. It merely states you cannot sign appx packages on Windows versions earlier than 8. – Daniel B Feb 10 '16 at 17:27
  • True, but if you look at how signing works, then signing only adds an overlay to the end of a file. This overlay contains different parameters for the file, so that if the file is changed, the signing is broken and should not be trusted any more. It's like an advanced CRC checksum. Signing appx packages/files or any other file are technically identical, just like making a CRC checksum of any kind of files. I still believe that my answer is valid till convinced otherwise. – Frank Jelstrup Feb 15 '16 at 15:38
  • Different file types are signed differently. But that’s not the point: The article on MSDN is simply not about .exe files at all. It applies only to appx packages. You tried to use a Windows 8 tool on Windows 7. That didn’t work. It doesn’t mean, however, that you can’t use the Windows 7 SDK version of SignTool to continue signing .exe files. – Daniel B Feb 15 '16 at 15:41
  • The windows 7 tool doesn't have the options needed to make SHA-256 signing and timestamping, so it does mean that Windows 7 SDK signtool shouldn't be used(Will add this to the question, good info). I know that MSDN write app packages, but I personally expect that it's all files and they use appx as an example of an file. This assumption is made as I use signtool to sign all kind of files, even file formats I create my self. Feel free to find a better answer, then I will give you the correct answer :) – Frank Jelstrup Feb 16 '16 at 9:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.