Knowledge Base

Pre-requisites: 

Signtool SDK from Microsoft (It can be downloaded here). 

USB token where the EV code signing certificate and the private key are provisioned. The steps for collecting an EV code signing certificate can be found here 

Install the SafeNet Authentication Client (It can be downloaded here).  

Note: The private key provisioned in the USB token cannot be exported as a PFX /2 file. 

The following command signs the file using the EV code signing certificate stored in the USB token. In the Windows command prompt type, the command is shared below. 

SignTool sign /tr http://timestamp.sectigo.com /td sha256 /fd sha256 /n "Your Company Name Inc." "C:\path\to\FileToSign.exe" 

 Where "Your Company Name Inc." is the certificate's Subject Name for which the EV code signing certificate is issued as shown in the screen shot shared below. Just double-click on the EV code signing certificate, then click on the Details tab 

"C:\path\to\FileToSign.exe" should be replaced with the actual location of the "EXE" or "MSI" file that you would like to sign using this certificate such as C:\Users\Desktop\foo.exe. 

If the process was successful, there will be the following response indicating that the program has been signed and timestamped.