Microsoft digital signature code signing using the SHA256 certificate

Microsoft was the first to announce the SHA-1 deprecation program, and after 2016 years windows and IE will no longer trust the SHA-1 certificate. Just as our company's digital signature also expires, simply re-applied for SHA256 and SHA1 new digital certificate, used to sign the product.

Looking at Signcode's document discovery,signcode 's command line-A is the signature algorithm used to specify a digital signature, supports only SHA1 and MD5, and does not support sha256.

/fd to specify signatures, MD5, SHA1, SHA256 are supported:

SignTool.exe sign/v/as/ac/f d:\test\sign\sign_sha256\xxx.pfx/p xxxx/t http://timestamp.wosign.com/timestamp/fd SHA256 signed file path

Problems:

The AS option does not recognize an issue that may cause: thesigntool version is too low, using the WIN10 SDK, directory C:\Program Files (x86) \ Windows Kits\10\bin\x86\signtool.exe. Dependent libraries have ncrypt.dll,bcrypt.dll and other DLLs that are only available on Vista and above systems. Need to copy to the old system to use SignTool.exe, while copying the same directory:

Appxpackaging.dll
Appxsip.dll
Mssign32.dll
Opcservices.dll
SignTool.exe
Signtool.exe.manifest
Wintrust.dll
Wintrust.dll.ini
Microsoft.Windows.Build.Appx.AppxPackaging.dll.manifest
Microsoft.Windows.Build.Appx.AppxSip.dll.manifest
Microsoft.Windows.Build.Appx.OpcServices.dll.manifest
Microsoft.Windows.Build.Signing.mssign32.dll.manifest
Microsoft.Windows.Build.Signing.wintrust.dll.manifest

The following error occurred in the trial:

SignTool error:the/t option is incompatible with THE/AS option.

SignTool error:specify the RFC 3161 timestamp server ' s URL instead with/tr.

Change/T to/tr, but error occurred:

SignTool error:the specified timestamp server either could not being reached orreturned an invalid response.

After some effort, replace the http://timestamp.wosign.com/timestamp with http://timestamp.wosign.com/rfc3161 or ttp:// Timestamp.geotrust.com/tsa solve the problem. http://timestamp.wosign.com/rfc3161 and Ttp://timestamp.geotrust.com/tsa are newer timestamp service formats, compatible with/T and /tr, and/HTTP The Timestamp.wosign.com/timestamp is only available for/T. Finally, two signature instructions are placed in a batch file:

set sign_folder=%~dp0%

%sign_folder%\signtool.exe sign/v/F%sign_folder%example.pfx/p Examplepassword "%1"

%sign_ Folder%\signtool.exe sign/v /as  /TR/HTTP/ TIMESTAMP.WOSIGN.COM/RFC3161/FD sha256   "%1"

This article is from the "8403723" blog, please be sure to keep this source http://8413723.blog.51cto.com/8403723/1767905

Microsoft digital signature code signing using the SHA256 certificate