Windows Code Signing:
SignTool, Certificates, and Secure Releases

🔑 Part 1: Purchasing a Code Signing Certificate

Code signing certificates are issued by trusted Certificate Authorities (CAs) that participate in the Microsoft Trusted Root Program [8]. The two main types are:

🏢 Where to Buy

Trusted CAs include:

• DigiCert – Industry leader, offers both OV and EV certificates
• GlobalSign – Enterprise-focused with hardware options
• Sectigo – Competitive pricing for OV certificates
• SSL.com – Affordable options, includes USB token delivery

💾 Hardware Token Requirement (June 2023+)

Since June 2023, industry standards require private keys to be stored on secure hardware (USB tokens or HSMs) [1]. Your certificate will typically ship on a SafeNet USB token (or similar). Keep it in a secure location when not in use—it contains your signing private key.

💻 Part 2: Installing Your Code Signing Certificate

Before signing, you need to import your certificate into Windows' certificate store. This process assumes you have a .pfx (PKCS#12) file containing both the certificate and private key.

📂 Step-by-Step: Import .pfx via Certificate Manager

Your certificate now appears under Personal > Certificates. Note the Issued To name (common name) and the Thumbprint—you'll need these for SignTool commands [7].

🛠️ Part 3: Installing SignTool (Windows SDK)

SignTool.exe is Microsoft's command-line utility for Authenticode signing. It comes with the Windows SDK [2].

📥 Download and Install Windows SDK

• Download the latest Windows SDK from Microsoft's official site [6].
• Run the installer. When prompted, select "Signing Tools for Desktop Apps" – you can deselect other features if you only need SignTool [6].
• Complete the installation. SignTool will be placed in a folder like:
  C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\signtool.exe
  (The version number may vary) [2].

🔧 Optional: Add SignTool to PATH

To run SignTool from any command prompt, add its folder to your system PATH [2]:

set PATH=%PATH%;C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\

Or add permanently via System Properties > Environment Variables.

✍️ Part 4: Signing Your .exe with SignTool

Now the core task. You'll use SignTool to attach a digital signature and—critically—a timestamp. A timestamp ensures your signature remains valid even after the certificate expires [1].

🔹 Basic Signing Command

signtool sign /tr http://timestamp.digicert.com /td SHA256 /fd SHA256 /a "C:\path\to\your\app.exe"

Breakdown of parameters [1][4]:

• /tr – RFC 3161 timestamp server (use your CA's server; examples: http://timestamp.digicert.com or http://timestamp.globalsign.com/tsa/r45standard)
• /td SHA256 – hash algorithm for the timestamp
• /fd SHA256 – file digest algorithm (SHA256 is mandatory for modern Windows)
• /a – automatically select the best certificate from your store

🔸 Signing with a Specific Certificate (by Name or Thumbprint)

If you have multiple certificates, specify the correct one using /n "Certificate Name" or /sha1 Thumbprint [4][7]:

# By common name
signtool sign /n "My Company Ltd." /tr http://timestamp.digicert.com /td SHA256 /fd SHA256 "C:\path\to\app.exe"

# By thumbprint (remove spaces)
signtool sign /sha1 3550ffca3cd652dde30675ce681ev1e01073e647 /tr http://timestamp.digicert.com /td SHA256 /fd SHA256 "C:\path\to\app.exe"

🔸 Hardware Token: SafeNet Password Prompt

If you're using a USB hardware token, ensure it's plugged in. Launch the SafeNet Authentication Client before signing. When you run SignTool, a password prompt will appear—enter the token's password [1].

🔍 Part 5: Verifying Your Signature

Always verify that the signature applied correctly [1][7]:

# Basic verification
signtool verify /pa "C:\path\to\app.exe"

# Detailed verification with output
signtool verify /pa /v "C:\path\to\app.exe"

You can also verify graphically: right-click the signed .exe > Properties > Digital Signatures tab. Select the signature and click Details—you should see "This digital signature is OK" [1].

☁️ Part 6: Alternative – Microsoft Artifact Signing

For cloud-based signing, Microsoft offers Artifact Signing (formerly Trusted Signing). It integrates with SignTool via a plugin and removes the need for physical hardware tokens [10]. Setup involves:

• Installing the Artifact Signing Client Tools MSI (via WinGet or manual download) [10]
• Creating a metadata.json file with your account endpoint and certificate profile [10]
• Using SignTool with the /dlib parameter to load the signing plugin [10]

📋 Quick Reference: Common SignTool Commands