I make my own certificate with signTool like
powershell.exe New-SelfSignedCertificate -DnsName "www.mydns.me" -Type CodeSigning -NotBefore 27.10.2021 -NotAfter 27.10.2024 -CertStoreLocation "cert:\CurrentUser\My"
The certificate is availabe in certificate manager
I signed my file with
signtool sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /a myfile.exe
I want to show certificates on the file with
signtool verify /pa myfile.exe
but it gave the source is not trusted
SignTool Error: A certificate chain processed, but terminated in a root
certificate which is not trusted by the trust provider.
Why is certificate not trusted when the option is /pa and is available in my certificate center.
The self signed certificate is self-signed and stored in your current user certificate Personal store.
This is not because you have the certificate that you trust it or the computer trust it.
You must import a copy of this certificate in the Trusted Root Certification Authorities. You can import it in the user store or computer store (any user on the local machine would trust your self signed certificate).
Use by example Import-Certificate -CertStoreLocation Cert:\CurrentUser\Root -FilePath C:\cert.cer. Only the public key must be imported in the Trusted Root Certification Authorities store and not the private key.
I don't know for the /pa option. Try without any option.
Related
I need to know how I can make sure certificate fields of my self-signed certificate, like subject common name and issuer common name, is encoded as PRINTABLE_STRING, IA5STRING or BMPSTRING, but not UTF-8 encoding.
I'm trying to create it using PowerShell cmdlet.
I'm trying to create a self-signed certificate that conforms to these rules.
These are the parameters I found that I think comply with those rules.
New-SelfSignedCertificate -DnsName 'wdac' -CertStoreLocation Cert:\CurrentUser\My\ -Type Codesigning -HashAlgorithm "SHA512" -KeyLength 4096 -KeyAlgorithm RSA
How To Generate A Self Signed Certificate Signed By An Root Certificate using New-SelfSignedCertificate, I Have A Root Certificate I Just Want to Know How To Use -Signer.
You already figured out that you need to use the -Signer parameter. Just ensure that you have the private key for the certificate you want to use to sign the new certificate. So basically you can only use certificates from the Personal store ("My" in PowerShell).
Example:
# find a suitable certificate to use as root
ls Cert:\CurrentUser\My\
$root = ls Cert:\CurrentUser\My\c123a6f16a5f165161a1... # use the thumbprint of one of your certificates
# create a certificate which is signed with your chosen root certificate
New-SelfSignedCertificate -DnsName test.local -Signer $root -CertStoreLocation Cert:\CurrentUser\My\
p12 file with 7 certificates in it.
Following the instruction that came along with the cert file, we have to use MMC and a password to import all certs into a personal store.Instruction also says to check mark private key exportable.
in order to automate this, I tried using certutil -importpfx but that only added 4 out of 7 certificates. I am unable to see other 3 certs. The diff i noticed is the imported certs are the ones with "ext issuing CA" and missing certs are with "issuing CA" in the Subject .
Any pointers please
I found an alternate solution using powershell instead of certutil .
Import-pfx with flag -exportable imported all the certs.
Import-PfxCertificate -CertStoreLocation Cert:\LocalMachine\My -Password $Securepwd -FilePath $findP12Cert.FullName -Exportable -Verbose
I have a question, basically I have a file one txt and another one xml, I would like to sign those files with self signed certificate using Powershell.
Is there a way to do it?
My steps would be like that?
First create a self signed certificate with powershell
Then use that certificate in Powershell to sign the documents
Is that correct?
Any idea how to do that?
After the document is signed do I have to provide to another party this self sigend certificate to be able to open the files right? Or how will it work?
Accidentally, all my scripts are signed with an issued certificate, and it's my cmdlets to sign:
$cert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert
Set-AuthenticodeSignature _path_to_my_script_ $cert -HashAlgorithm `
sha256 -TimestampServer "http://timestamp.digicert.com"
As to certificate, an issued one is recommended, rather than a self-signed one, it's not very expensive.
If you want to use a self-signed certificate, I think this cmdlet helps you:
New-SelfSignedCertificate -FriendlyName "My Cert" -KeyUsage DigitalSignature -KeyUsageProperty Sign -KeyLength 2018 -KeyAlgorithm sha256 -Type CodeSigningCert -Subject "CN=System Error,e=mymail#mail.com"
I never created self-signed certificate on a personal computer, so this cmdlet is not verified. :(
If you have further questions, please let me know. :)
I try to import certificate in powershell as the following
Import-PfxCertificate -FilePath "$certFolder\$certFile" -CertStoreLocation Cert:\LocalMachine\Root -Password $securedPassword
The command run without any errors but the certificate is placed under Intermediate CAs with the information that CA root is not trusted.
When I import the same certificate manually with the option checked "Automatically select the certificate store..." it is placed properly under the Trusted CAs.
What do I miss while importing the certificate automatically?