当前位置：文江博客话题详情

如何在 Windows 上创建用于代码签名的自签名证书？

发布于 2024-07-04 22:45:22 字数 39 浏览 5 评论 0原文

如何使用 Windows SDK 创建用于代码签名的自签名证书？

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

丘比特射中我 2024-07-11 22:45:28

对于设备驱动程序，您可以在 Visual Studio 2019 的项目属性中生成一个。在“驱动程序签名”部分中，“测试证书”字段有一个下拉列表。生成测试证书是选项之一。该证书将位于扩展名为“cer”的文件中，通常与可执行文件或驱动程序位于同一输出目录中。

打开项目的属性：

然后打开“驱动程序签名”部分，然后单击左侧的“常规”。
单击“测试证书”右侧的下拉菜单，然后选择“<创建测试证书...>”

回复收藏 0 原文

不忘初心 2024-07-11 22:45:28

这篇文章将仅回答“如果有证书，如何签署 EXE 文件”部分：

签名一个 Windows EXE 文件

为了对 exe 文件进行签名，我使用了 MS“signtool.exe”。为此，您需要下载臃肿的 MS Windows SDK，其大小高达 1GB。幸运的是，您不必安装它。只需打开 ISO 并提取“Windows SDK Signing Tools-x86_en-us.msi”即可。它只有 400 KB。

然后我构建了这个小脚本文件：

prompt $
echo off
cls

copy "my.exe" "my.bak.exe"

"c:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\x64\signtool.exe" sign /fd SHA256 /f MyCertificate.pfx /p MyPassword My.exe

pause

This post will only answer the "how to sign an EXE file if you have the certificate" part:

Signing a Windows EXE file

To sign the exe file, I used MS "signtool.exe". For this you will need to download the bloated MS Windows SDK which has a whooping 1GB. FORTUNATELY, you don't have to install it. Just open the ISO and extract "Windows SDK Signing Tools-x86_en-us.msi". It has a merely 400 KB.

Then I built this tiny script file:

prompt $
echo off
cls

copy "my.exe" "my.bak.exe"

"c:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\x64\signtool.exe" sign /fd SHA256 /f MyCertificate.pfx /p MyPassword My.exe

pause

回复收藏 0 原文

错々过的事 2024-07-11 22:45:27

从 PowerShell 4.0 (Windows 8.1/Server 2012 R2) 开始，可以在Windows 没有 makecert.exe< /a>.

您需要的命令是 New-SelfSignedCertificate 和导出 PfxCertificate。

说明位于使用 PowerShell 创建自签名证书 。

回复收藏 0 原文

你的呼吸 2024-07-11 22:45:26

罗杰的回答非常有帮助。

不过，我在使用它时遇到了一些麻烦，并且不断出现红色的“Windows 无法验证此驱动程序软件的发布者”错误对话框。关键是安装测试根证书，

certutil -addstore Root Demo_CA.cer

罗杰的答案并没有完全涵盖。

这是一个对我有用的批处理文件（带有我的 .inf 文件，不包括在内）。
它展示了如何从头到尾完成这一切，根本不需要 GUI 工具
（除了一些密码提示之外）。

REM Demo of signing a printer driver with a self-signed test certificate.
REM Run as administrator (else devcon won't be able to try installing the driver)
REM Use a single 'x' as the password for all certificates for simplicity.

PATH %PATH%;"c:\Program Files\Microsoft SDKs\Windows\v7.1\Bin";"c:\Program Files\Microsoft SDKs\Windows\v7.0\Bin";c:\WinDDK\7600.16385.1\bin\selfsign;c:\WinDDK\7600.16385.1\Tools\devcon\amd64

makecert -r -pe -n "CN=Demo_CA" -ss CA -sr CurrentUser ^
   -a sha256 -cy authority -sky signature ^
   -sv Demo_CA.pvk Demo_CA.cer

makecert -pe -n "CN=Demo_SPC" -a sha256 -cy end ^
   -sky signature ^
   -ic Demo_CA.cer -iv Demo_CA.pvk ^
   -sv Demo_SPC.pvk Demo_SPC.cer

pvk2pfx -pvk Demo_SPC.pvk -spc Demo_SPC.cer ^
   -pfx Demo_SPC.pfx ^
   -po x

inf2cat /drv:driver /os:XP_X86,Vista_X64,Vista_X86,7_X64,7_X86 /v

signtool sign /d "description" /du "www.yoyodyne.com" ^
   /f Demo_SPC.pfx ^
   /p x ^
   /v driver\demoprinter.cat

certutil -addstore Root Demo_CA.cer

rem Needs administrator. If this command works, the driver is properly signed.
devcon install driver\demoprinter.inf LPTENUM\Yoyodyne_IndustriesDemoPrinter_F84F

rem Now uninstall the test driver and certificate.
devcon remove driver\demoprinter.inf LPTENUM\Yoyodyne_IndustriesDemoPrinter_F84F

certutil -delstore Root Demo_CA

Roger's answer was very helpful.

I had a little trouble using it, though, and kept getting the red "Windows can't verify the publisher of this driver software" error dialog. The key was to install the test root certificate with

certutil -addstore Root Demo_CA.cer

which Roger's answer didn't quite cover.

Here is a batch file that worked for me (with my .inf file, not included).
It shows how to do it all from start to finish, with no GUI tools at all
(except for a few password prompts).

REM Demo of signing a printer driver with a self-signed test certificate.
REM Run as administrator (else devcon won't be able to try installing the driver)
REM Use a single 'x' as the password for all certificates for simplicity.

PATH %PATH%;"c:\Program Files\Microsoft SDKs\Windows\v7.1\Bin";"c:\Program Files\Microsoft SDKs\Windows\v7.0\Bin";c:\WinDDK\7600.16385.1\bin\selfsign;c:\WinDDK\7600.16385.1\Tools\devcon\amd64

makecert -r -pe -n "CN=Demo_CA" -ss CA -sr CurrentUser ^
   -a sha256 -cy authority -sky signature ^
   -sv Demo_CA.pvk Demo_CA.cer

makecert -pe -n "CN=Demo_SPC" -a sha256 -cy end ^
   -sky signature ^
   -ic Demo_CA.cer -iv Demo_CA.pvk ^
   -sv Demo_SPC.pvk Demo_SPC.cer

pvk2pfx -pvk Demo_SPC.pvk -spc Demo_SPC.cer ^
   -pfx Demo_SPC.pfx ^
   -po x

inf2cat /drv:driver /os:XP_X86,Vista_X64,Vista_X86,7_X64,7_X86 /v

signtool sign /d "description" /du "www.yoyodyne.com" ^
   /f Demo_SPC.pfx ^
   /p x ^
   /v driver\demoprinter.cat

certutil -addstore Root Demo_CA.cer

rem Needs administrator. If this command works, the driver is properly signed.
devcon install driver\demoprinter.inf LPTENUM\Yoyodyne_IndustriesDemoPrinter_F84F

rem Now uninstall the test driver and certificate.
devcon remove driver\demoprinter.inf LPTENUM\Yoyodyne_IndustriesDemoPrinter_F84F

certutil -delstore Root Demo_CA

回复收藏 0 原文

_蜘蛛 2024-07-11 22:45:25

使用 New-SelfSignedCertificate Powershell 中的命令。
打开 powershell 并运行这 3 个命令。

创建证书：

$cert = New-SelfSignedCertificate -DnsName www.yourwebsite.com -Type CodeSigning -CertStoreLocation 证书：\CurrentUser\My

为其设置密码：

$CertPassword = ConvertTo-SecureString -String "my_passowrd" -Force -AsPlainText

导出：

Export-PfxCertificate -Cert "cert:\CurrentUser\My\$($cert.Thumbprint)" -FilePath "d:\selfsigncert.pfx" -Password $CertPassword

您的证书 selfsigncert.pfx 将位于 @ D:/

可选步骤： 您还需要将证书密码添加到系统环境变量中。通过在 cmd 中输入以下内容来执行此操作：

setx CSC_KEY_PASSWORD "my_password"

It's fairly easy using the New-SelfSignedCertificate command in Powershell.
Open powershell and run these 3 commands.

Create certificate:

$cert = New-SelfSignedCertificate -DnsName www.yourwebsite.com -Type CodeSigning -CertStoreLocation Cert:\CurrentUser\My

Set the password for it:

$CertPassword = ConvertTo-SecureString -String "my_passowrd" -Force -AsPlainText

Export it:

Export-PfxCertificate -Cert "cert:\CurrentUser\My\$($cert.Thumbprint)" -FilePath "d:\selfsigncert.pfx" -Password $CertPassword

Your certificate selfsigncert.pfx will be located @ D:/

Optional step: You would also require to add certificate password to system environment variables. do so by entering below in cmd:

setx CSC_KEY_PASSWORD "my_password"

回复收藏 0 原文

拥醉 2024-07-11 22:45:24

正如答案中所述，为了使用一种未弃用的方式来签署自己的脚本，应该使用新的 SelfSignedCertificate。

生成密钥：

New-SelfSignedCertificate -DnsName [email protected] -Type CodeSigning -CertStoreLocation cert:\CurrentUser\My

导出不带私钥的证书：

Export-Certificate -Cert (Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert)[0] -FilePath code_signing.crt

[0] 将使此工作适用于您拥有多个证书的情况...显然使索引与您要使用的证书匹配...或使用一种方法过滤（按指纹或发行人）。

将其导入为受信任的发布者

Import-Certificate -FilePath .\code_signing.crt -Cert Cert:\CurrentUser\TrustedPublisher

将其导入为根证书颁发机构。

Import-Certificate -FilePath .\code_signing.crt -Cert Cert:\CurrentUser\Root

签署脚本（假设此处名为 script.ps1，相应地修复路径）。

Set-AuthenticodeSignature .\script.ps1 -Certificate (Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert)

显然，一旦设置了密钥，您就可以简单地用它签署任何其他脚本。
您可以在这篇文章。

As stated in the answer, in order to use a non deprecated way to sign your own script, one should use New-SelfSignedCertificate.

Generate the key:

New-SelfSignedCertificate -DnsName [email protected] -Type CodeSigning -CertStoreLocation cert:\CurrentUser\My

Export the certificate without the private key:

Export-Certificate -Cert (Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert)[0] -FilePath code_signing.crt

The [0] will make this work for cases when you have more than one certificate... Obviously make the index match the certificate you want to use... or use a way to filtrate (by thumprint or issuer).

Import it as Trusted Publisher

Import-Certificate -FilePath .\code_signing.crt -Cert Cert:\CurrentUser\TrustedPublisher

Import it as a Root certificate authority.

Import-Certificate -FilePath .\code_signing.crt -Cert Cert:\CurrentUser\Root

Sign the script (assuming here it's named script.ps1, fix the path accordingly).

Set-AuthenticodeSignature .\script.ps1 -Certificate (Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert)

Obviously once you have setup the key, you can simply sign any other scripts with it.
You can get more detailed information and some troubleshooting help in this article.

回复收藏 0 原文

南街九尾狐 2024-07-11 22:45:22

更新的答案

如果您使用以下 Windows 版本或更高版本：Windows Server 2012、Windows Server 2012 R2 或 Windows 8.1，则 MakeCert 现已弃用，Microsoft 建议使用 PowerShell Cmdlet New-SelfSignedCertificate。

如果您使用的是旧版本（例如 Windows 7），则需要坚持使用 MakeCert 或其他解决方案。有些人建议公钥基础设施 Powershell (PSPKI) 模块。

原始答案

虽然您可以创建自签名代码签名证书（SPC - 软件发行商证书）一次性，我更喜欢执行以下操作：

创建自签名证书颁发机构（CA）

makecert -r -pe -n "CN=My CA" -ss CA -sr CurrentUser ^
         -a sha256 -cy authority -sky signature -sv MyCA.pvk MyCA.cer

（^ =允许批处理命令行换行）

这将创建一个自签名（-r）证书，带有可导出的私钥 (-pe)。它名为“My CA”，应放置在当前用户的 CA 存储中。我们使用 SHA-256 算法。密钥用于签名（-sky）。

私钥应存储在 MyCA.pvk 文件中，证书应存储在 MyCA.cer 文件中。

导入 CA 证书

如果您不信任 CA 证书，那么它就没有意义，因此您需要将其导入到 Windows 证书存储中。您可以使用证书MMC管理单元，但是从命令行：

certutil -user -addstore Root MyCA.cer

创建代码签名证书（SPC）

makecert -pe -n "CN=My SPC" -a sha256 -cy end ^
         -sky signature ^
         -ic MyCA.cer -iv MyCA.pvk ^
         -sv MySPC.pvk MySPC.cer

它与上面几乎相同，但是我们提供了颁发者密钥和证书（ -ic 和 -iv 开关）。

我们还需要将证书和密钥转换为 PFX 文件：

pvk2pfx -pvk MySPC.pvk -spc MySPC.cer -pfx MySPC.pfx

如果您使用密码，请使用以下内容

pvk2pfx -pvk MySPC.pvk -spc MySPC.cer -pfx MySPC.pfx -po fess

如果您想保护 PFX 文件，请添加 -po 开关，否则 PVK2PFX 将创建一个没有密码的 PFX 文件。

使用证书对代码进行签名

signtool sign /v /f MySPC.pfx ^
              /t http://timestamp.url MyExecutable.exe

（了解为什么时间戳可能很重要）

如果您将 PFX 文件导入到证书存储中（您可以使用 PVKIMPRT 或 MMC 管理单元），您可以按如下方式对代码进行签名：

signtool sign /v /n "Me" /s SPC ^
              /t http://timestamp.url MyExecutable.exe

signtool /t 的一些可能的时间戳 URL 为：

http://timestamp.verisign.com/scripts/timstamp.dll
http://timestamp.globalsign.com/scripts/timstamp.dll
http://timestamp.comodoca.com/authenticode
http:// /timestamp.digicert.com

完整的 Microsoft 文档

signtool
< a href="http://msdn.microsoft.com/en-us/library/bfsktky3.aspx" rel="noreferrer">makecert
pvk2pfx

下载

For those who are not .NET developers, you will need a copy of the Windows SDK and .NET framework. A current link is available here: [SDK & .NET][5] (which installs makecert in `C:\Program Files\Microsoft SDKs\Windows\v7.1`). Your mileage may vary.

MakeCert 可从 Visual Studio 命令提示符获取。 Visual Studio 2015 确实有它，并且可以从 Windows 7 中的“开始”菜单中的“VS 2015 开发人员命令提示符”或“VS2015 x64 本机工具命令提示符”（可能全部都在同一文件夹中）下启动。

Updated Answer

If you are using the following Windows versions or later: Windows Server 2012, Windows Server 2012 R2, or Windows 8.1 then MakeCert is now deprecated, and Microsoft recommends using the PowerShell Cmdlet New-SelfSignedCertificate.

If you're using an older version such as Windows 7, you'll need to stick with MakeCert or another solution. Some people suggest the Public Key Infrastructure Powershell (PSPKI) Module.

Original Answer

While you can create a self-signed code-signing certificate (SPC - Software Publisher Certificate) in one go, I prefer to do the following:

Creating a self-signed certificate authority (CA)

makecert -r -pe -n "CN=My CA" -ss CA -sr CurrentUser ^
         -a sha256 -cy authority -sky signature -sv MyCA.pvk MyCA.cer

(^ = allow batch command-line to wrap line)

This creates a self-signed (-r) certificate, with an exportable private key (-pe). It's named "My CA", and should be put in the CA store for the current user. We're using the SHA-256 algorithm. The key is meant for signing (-sky).

The private key should be stored in the MyCA.pvk file, and the certificate in the MyCA.cer file.

Importing the CA certificate

Because there's no point in having a CA certificate if you don't trust it, you'll need to import it into the Windows certificate store. You can use the Certificates MMC snapin, but from the command line:

certutil -user -addstore Root MyCA.cer

Creating a code-signing certificate (SPC)

makecert -pe -n "CN=My SPC" -a sha256 -cy end ^
         -sky signature ^
         -ic MyCA.cer -iv MyCA.pvk ^
         -sv MySPC.pvk MySPC.cer

It is pretty much the same as above, but we're providing an issuer key and certificate (the -ic and -iv switches).

We'll also want to convert the certificate and key into a PFX file:

pvk2pfx -pvk MySPC.pvk -spc MySPC.cer -pfx MySPC.pfx

If you are using a password please use the below

pvk2pfx -pvk MySPC.pvk -spc MySPC.cer -pfx MySPC.pfx -po fess

If you want to protect the PFX file, add the -po switch, otherwise PVK2PFX creates a PFX file with no passphrase.

Using the certificate for signing code

signtool sign /v /f MySPC.pfx ^
              /t http://timestamp.url MyExecutable.exe

(See why timestamps may matter)

If you import the PFX file into the certificate store (you can use PVKIMPRT or the MMC snapin), you can sign code as follows:

signtool sign /v /n "Me" /s SPC ^
              /t http://timestamp.url MyExecutable.exe

Some possible timestamp URLs for signtool /t are:

http://timestamp.verisign.com/scripts/timstamp.dll
http://timestamp.globalsign.com/scripts/timstamp.dll
http://timestamp.comodoca.com/authenticode
http://timestamp.digicert.com

Full Microsoft documentation

Downloads

MakeCert is available from the Visual Studio Command Prompt. Visual Studio 2015 does have it, and it can be launched from the Start Menu in Windows 7 under "Developer Command Prompt for VS 2015" or "VS2015 x64 Native Tools Command Prompt" (probably all of them in the same folder).

回复收藏 0 原文

~没有更多了~

关于作者

颜漓半夏

暂无简介

0 文章

0 评论

21 人气

关注发私信

友情链接

文江博客

如何在 Windows 上创建用于代码签名的自签名证书？

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

评论（7）

更新的答案

原始答案

创建自签名证书颁发机构（CA）

导入 CA 证书

创建代码签名证书（SPC）

使用证书对代码进行签名

完整的 Microsoft 文档

下载

Updated Answer

Original Answer

Creating a self-signed certificate authority (CA)

Importing the CA certificate

Creating a code-signing certificate (SPC)

Using the certificate for signing code

Full Microsoft documentation

Downloads

关于作者

相关话题

热门标签

推荐作者

qq_FjTq5B

18273202778

WordPress小学生

〃温暖了心ぐ

迷乱花海

niuniu

友情链接

如何在 Windows 上创建用于代码签名的自签名证书？

如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

评论（7）

更新的答案

原始答案

创建自签名证书颁发机构（CA）

导入 CA 证书

创建代码签名证书（SPC）

使用证书对代码进行签名

完整的 Microsoft 文档

下载

Updated Answer

Original Answer

Creating a self-signed certificate authority (CA)

Importing the CA certificate

Creating a code-signing certificate (SPC)

Using the certificate for signing code

Full Microsoft documentation

Downloads

关于作者

相关话题

热门标签

推荐作者

qq_FjTq5B

18273202778

WordPress小学生

〃温暖了心ぐ

迷乱花海

niuniu

友情链接

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。