13

I followed this link to sign my exe application.

  • I installed SDK tool on Windows 7,

  • run C:\Program Files\Microsoft SDKs\Windows\v6.1\Bin>makecert.exe -sv App-O.pvk -n "CN=MY DIGITAL KEY" App-O.cer

Dialog opened to provide password:

enter image description here

I wrote password : 'fess'

new window opened:

enter image description here

I entered: 'fess'

#Succeeded

files App-O.cer and App-O.pvk creaded.

now I generate pfx:

pvk2pfx.exe -pvk App-O.pvk -spc App-O.cer -pfx App-O.pfx

Dialog opened to provide password:

enter image description here

i pasted 'fess'

file pfx created.

Now i run signtool:

 C:\Program Files\Microsoft SDKs\Windows\v6.1\Bin>signtool.exe sign /f "App-O.pfx" /p fess "C:\Output\setup.exe"

Here I got the error:

SignTool Error: The specified PFX password is not correct.

Number of files successfully Signed: 0
Number of warnings: 0
Number of errors: 1

What did I miss?

BTW, the same error I get from CMD shell of Windows SDK.

Thanks,

4 Answers 4

27
+100

There are a couple of problems.

First of all you are using self-signed certificate, so you should define it explicitly by adding -r key to makecert command or you'll get an error "The signer's certificate is not valid for signing" at sign step.

Next, at this step

signtool.exe sign /f "App-O.pfx" /p fess "C:\Output\setup.exe"

you are trying to open pfx using password "fess". But you actually didn't set any password for pfx file. To do it you should add -po key to pfx creation command.

After that you can sign your application.

So the correct process will be:

makecert.exe -sv App-O.pvk -n "CN=MY DIGITAL KEY" App-O.cer -r

pvk2pfx.exe -pvk App-O.pvk -spc App-O.cer -pfx App-O.pfx -po fess

signtool.exe sign /f "App-O.pfx" /p fess "C:\Output\setup.exe"

Here is some useful links:

4
  • 1
    Hmm, "do it you should add -po key to pfx creation command." when I runpvk2pfx.exe -pvk App-O.pvk -spc App-O.cer -pfx App-O.pfx password dialog opened where i provide password. I thought its the same as to add : -po fess. Or im wrong Commented Apr 20, 2013 at 18:52
  • Yep, mate, thank you you are right :) ill add u +100 after 18 hours Commented Apr 20, 2013 at 18:55
  • If you don't want to expose your password, install the private key and use the signtool /a option which chooses the "best" key from the store that matches the CN etc you specify. Commented Jun 2, 2015 at 2:51
  • 1
    Adding "/p mypassword" solved my issue for Rhino plugin signing. Thanks!
    – Tahirhan
    Commented Jan 4, 2023 at 7:18
15

Just stumbled accross this question when receiving a similar error with a DigiCert code signing certificate just on some machines.

Turns out I had selected SHA256 encryption instead of TripleDES-SHA1 when exporting the certificate and one of our build machines is still running Windows Server 2012 R2. This OS is obviously not capable of decrypting the certificate then, resulting in the same (irritating in this case) error message.

UPDATE: The same behaviour also occurs on Azure Devops classic pipelines using Hosted VS2017 pipeline and a DigiCert certificate.

The new YAML pipelines work with the SHA256

1
  • 1
    It seems like there is no command to let pvk2pfx select the export encryption type (SHA256 vs 3DES) Commented Dec 20, 2019 at 9:30
1

OMG! !

Order of the Options given Matters. Especially If you are a Linux person, take this into consideration.

signtool sign /f C:\Users\Administrator\Downloadsmycert.pfx /p uptycs  /tr http://timestamp.comodoca.com /debug /td SHA256 /fd SHA256 myapp.exe

First I mentioned /p password at the end of command which used to fail all the times.

1
  • 🤦🏻‍♂️typical Microsoft.
    – QkiZ
    Commented Jul 19 at 13:09
0

You just need to add -pi parameter (password of your pvk file) like that:

pvk2pfx.exe -pvk App-O.pvk -pi fess -spc App-O.cer -pfx App-O.pfx -po fess -f

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.