Code signing never asks for the passsword, silently fails

[jmoleary]

I've been code-signing my AI installers with a Digicert USB key for a while now. The procedure this this

1. I check the "Enable Signing" box in the installer
2. The correct certificate (the only one) is selected
3. I build the app
4. The password dialog for my Digicert dongle comes up.
5. I enter the password and signing finishes


But lately, something odd has been happening. I never get the password dialog. Instead the entire signing process goes all the way, it tells me is singed the MSI. But it produces an installer that is not trusted by anyone.

I do see this in the output pane

Writing Summary Information
Signing MSI
This file was signed with the certificate: d03ff007-4e47-4f6e-9e5a-e818ab5044b5
Creating EXE file
Signing EXE file
This file was signed with the certificate: d03ff007-4e47-4f6e-9e5a-e818ab5044b5
Validating MSI

But Windows Smartscreen still does not like the binary produced

Even if I reboot the PC, I am never asked for the password. I know this is wrong, but I cannot figure how to make AI do... whatever it is supposed to do to trigger the password dialog.

Even if I turn off "Single Logon" in the SafeNet client utility, before rebooting, I am still not asked ever fopr my dongle pasword.

(Note: My certificates are paid through next year and up to date).

To diagnose this further, I have looked at the Digital Certificate properties (went to File Explorer, right clicked on the AI-generated installer .EXE file, chose "Properties" and then "Digital Certifcates". The older certificates where it worked show my company's name in the "Name of signer field.
The newer, bad ones (which do not work) instead show that GUID (above) in the "Name of Signer"

1. Has something changed in how code-signing works?
2. Is there a log file somewhere in which I see exactly what command line the AI supplies to signtool in order to replicate it on the command line myself to try to diagnose the issue?

[jmoleary]

I am answering my question here because I found a workaround.

I began to suspect that AI was not using the right certificate. It says it does. It has it highlighted in the UI but the signed binary makes itt look like it does not.

Until now I have relied upon the standard dropdown in the code-signing page to properly choose my certificate. It shows my certificate as selected when I enable code-signing so I thought I was all good. This has worked for over a year.

But the workaround I found was to use a custom command-line. When I choose that option, I take what AI gives me (it does fill one out) but then I add one single clause which is the /n clause to name my certificate. Once I do that, it finds the correct certificate and properly signs my code

[Catalin]

Hello,

Thank you for your followup on this and for sharing the solution with us!

I am sure this will be of help for further users facing a similar scenario.

Best regards,
Catalin