How to sign code with only a .SPC file

code-signingcodesign

I use InstallShield 2010 which requires a SPC/PFX and a PVK file to sign my files. I just got a Code Signing CERT but all they gave me was a SPC file. I right-clicked it and installed it in Windows 7. I assume the PVK file is somewhere on this system but I cannot find it using the Certificates MMC, etc.

So how will I use this SPC file in InstallShield to sign my files without have a PVK file? I can view the certificate in "My Store" (Personal certs) and export it to a .CER or P7B but the PFX option is grayed out so I can't export the PVK for some reason.

Is it possible to sign using InstallShield without a PVK file? I'm also concerned what will happen if I have to reload this computer, how will I install this code signing .SPC again with no PVK file? I'm used to keeping PFX files on my backup system. It's a 3 year cert so I imagine in 3 years I am going to reload this computer.

Best Answer

This works from IE, you just have to know the hoops.

Download the .spc certificate from GoDaddy. Go to IE->Tools->Internet Options->Content->Certificates->Personal. If the cert is not there, import it. Once it is there, then you can chose Export->Next->Yes, Export private key->Personal Information Exchange - PKCS #12 (.PFX)

Related Solutions

How to sign exes and dlls with the code signing certificate

First, you can generate your own pfx file using the pvk2pfx tool described at http://msdn.microsoft.com/en-us/library/ff549703(VS.85).aspx

Something like

pvk2pfx -pvk cert.pvk -spc cert.spc -pfx cert.pfx -pi password

ought to do the trick.

Secondly, signtool is the tool you're after. http://msdn.microsoft.com/en-us/library/aa387764(VS.85).aspx

signtool sign /?

Gets you the help, but the basic command you're probably after is

signtool sign /f cert.pfx /p password target.exe

Which will sign target.exe. It gets more complex if you want to put the certificate into the certificate store on the machine (this is the CSP bit). This is really useful though for doing signing on a lot of dev machines, or on build lab machines where you want to avoid putting the certificate in source control.

PVK2PFX Error 0x80070490 – Cannot find certificates that match the key

Turns out that this year we were given a new private key.

Well, you're not given a private key, the certificate+key is fetched through the browser and stored in a certificate store. From there we can export a .PFX (A pfx contains a certificate and a private key).

With this PFX exported from the browser's certificate store, we can use it directly to sign code with signtool.

Note: We were actually gluttons for punishment, and went through steps:

+--[.pfx]---+     +--[.cer]---+     +--[.spc]---+           +--[.pfx]---+
|Certificate|====>|Certificate|====>|Software   |=========> |Certificate|
|    +      |     +-----------+     |Publishing |           |     +     |
|Private Key|==+       +            |Certificate|   +=====> |Private Key|
+-----------+  |                    +-----------+   |       +-----------+
               |                                    | 
               |                                    |
               |  +--[.pem]---+     +--[.pvk]---+   |
               +=>|Private Key| ==> |Private Key|===+
                  +-----------+     +-----------+

But all that route gave us was a private key file (*.pvk) that wasn't protected with a password; so signtool could run without user interaction.

But the answer to this question was: The private key doesn't match the certificate.

Best Answer

Related Solutions

How to sign exes and dlls with the code signing certificate

PVK2PFX Error 0x80070490 – Cannot find certificates that match the key

Related Topic