Changes between Version 1 and Version 2 of windows-signing

Timestamp:

Oct 9, 2025, 4:35:39 PM (9 days ago)

Author:

Greg Couch

Comment:

--

windows-signing

@@ -3 +3 @@
 This is how we do automated code signing of Windows binaries using a !YubiKey.  We started with:
 
-* Enterprise Contract with Sectigo, https://www.sectigo.com
+* Enterprise Contract with [https://www.sectigo.com Secitgo]
 * !YubiKey 5 FIPS
-* !YubiKey Smart Card Minidriver (Windows) from https://www.yubico.com/support/download/smart-card-drivers-tools/
-* yubio-piv-tool from https://developers.yubico.com/yubico-piv-tool/
+* [https://www.yubico.com/support/download/smart-card-drivers-tools/ YubiKey Smart Card Minidriver (Windows)] 
+* [https://developers.yubico.com/yubico-piv-tool/ yubio-piv-tool]
+* !YubiKey Authenticator application from Windows Store
 * signtool from Microsoft Visual Studio
-* scsigntool from https://www.mgtek.com/smartcard
+* MGTEK's [https://www.mgtek.com/smartcard scsigntool]
 
-Outline:
+Protocol:
 
-* Used !YubiKey Authenticator application from Windows Store to set PIN, PUK, and Management Key
+* Use !YubiKey Authenticator application to set PIN, PUK, and Management Key (could use yubio-piv-tool instead)
 * Install !YubiKey Smart Card Minidriver
+  * [https://support.yubico.com/hc/en-us/articles/360015654560-Deploying-the-YubiKey-Smart-Card-Minidriver-to-workstations-and-servers installation notes]
 * Install yubio-piv-tool
 * Get email invitation to submit code signing CSR to Sectigo initiated by corporate IT
@@ -66 +68 @@
 `yubico-piv-tool --action=import-certificate --slot=$SLOT --key --pin-policy=once --touch-policy=never --input=$CERT_BASE_cert.cer`
 
-== Install intermediate certificates onto !YubiKey
+=== Install intermediate certificates onto !YubiKey
 
 Use "Root/Intermediate(s) only, PEM encoded" certificates.  Downloads as `CERT_BASE_interm.cer`.
@@ -90 +92 @@
 == Sign Code
 
-Microsoft's `signtool` doesn't have a way to provide the PIN needed use the private key.  So use MGTEK's `scsigntool` to wrap signtool.  In our case:
+Microsoft's `signtool` doesn't have a way to provide the PIN needed utilize the private key.  So use MGTEK's `scsigntool` to wrap signtool.  `ScSignTool.exe` and `ScSignTool.dll` are placed in the directory where `signtool` is used.
+
+For example:
 {{{
 scsigntool.exe -pin CODESIGN sign /v /a /sha1 CERT_SHA /fd sha256 /t http://timestamp.sectigo.com/authenticode /d "Application Name" app-installer.exe