code-signing - 无法使用代码签名证书对代码进行签名

Question

我们购买了 Microsoft Authenticode Thawte 的证书。现在我把它放在一个 PFX 文件中。我尝试以下操作:

D:\sign>signtool sign /f ./cert/cert.pfx /p mypass /t http://timestamp.verisign.com/scripts/timstamp.dll "mySetup.exe"
Done Adding Additional Store
Successfully signed and timestamped: mySetup.exe

但是当我运行 mySetup.exe 时，它以未签名的方式运行，并显示“Unknown Publishier”。当我使用 SignTool 验证 EXE 文件时，我得到了关注。

D:\sign>SignTool verify mySetup.exe
SignTool Error: WinVerifyTrust returned error: 0x800B010A
SignTool Error: File not valid: mySetup.exe

Number of errors: 1

怎么了？

Answer 1

可能与Thawte使用中间证书进行签名有关。他们认为这在 best practices 之内，我不会以任何方式争论。

但是，从最终用户的角度来看，这可能会导致并发症。这是 known issue with VSTO (Visual Studio Tools for Office) 使用 ClickOnce 的解决方案，可能会影响您。

遗憾的是，处理此问题的解决方案是您需要将适当的中间 CA 证书添加到所有最终用户计算机:

Resolution

The workaround to this issue is to include the Intermediate Certificate Authorities’ certificate on all end user machines where the application will be installed. As of now the issue is reported only with the handling of Thawte certificate and would require that Thawte intermediate certificate be installed on the end users machine.

Thawte provides links to the appropriate CA certs for their Intermediate Certificates