Code Signing with Sectigo USB token

[nedumaran]

I used to sign my files with a file based certificate. But now I have been asked to use a usb token, which I have purchased and installed. I am able to sign my exe files from the command line with signtool. It requests for my password and once I enter it, it's signed.

However, I am not able to use it in AdvanceInstaller.

AI does recognise the device as a store but when I build, it throws an error saying "Error message: 'SignTool Error: No certificates were found that met all the given criteria."

But I am able to sign my files from the command line. How do I get this to work with AdvancedInstller.

[Dan]

Hello,

We are aware of the issue on certain devices, it appears the root certificate isn’t trusted on those machines, we’re actively investigating. We’ll share a fix as soon as it’s available. Please also note that the current error message is misleading.

Since signing works correctly when you run the SignTool command manually, could you please verify whether the same signing operation succeeds when configured in Advanced Installer? You don’t need to specify individual files, Advanced Installer will automatically append every file marked for signing during the build.

external-sign-tool.png (27.22 KiB) Viewed 6405 times

Thank you for bring this to our attention.

Best regards,
Dan

[nedumaran]

Hello Dan,

I tried with custom settings and passed the same arguments as I did in the command line, minus the filename. I got the same (misleading) error:

Code: Select all

SignTool Error: No certificates were found that met all the given criteria.

I also tried passing the thump pint as you had advised over email. There was no change in response.

I look forward to to a fix soon. In the meantime, are there any other ways I can package signed apps? Should I sign them individually from the command line and then sign the setup exe file also from the command line? Will I miss anything if I do this?

Warm regards.

~ MUTHU

[Dan]

Hello,

Using an external SignTool as a workaround appears to have resolved the issue:

custom-signtool-arm.png (26.08 KiB) Viewed 6353 times

We have further investigated this issue over email and in this particular case, the end-user had an ARM device, so he had to select the ARM version of SignTool that comes with the Windows SDK archive.

We're still investigating why the validation fails with the built-in support from Advanced Installer.

Let us know if you encountered this behavior and what was the fix that worked for you.

Best regards,
Dan

[nedumaran]

Hello Dan,

Thank you for the continuous follow up. When I used the external signtool, it worked. I don't think it had to be an ARM64 version, but I have not tested with the external x64 binary. I've not had any problems running X64 binaries. I can test it for you if you want me to.

[nedumaran]

Hello Dan,

I tried setting the x64 version of SignTool to sign the packing I am building in my Arm64 machine. I got back the error:

Code: Select all

 'SignTool Error: No certificates were found that met all the given criteria.

I switched back to the Arm64 version and the signing went through without problems. Just wanted to let you know.

[Catalin]

Hello,

Thank you for your followup on this!

We'll update this thread when we'll find more information on this.

Best regards,
Catalin

[nedumaran]

I can no longer sign after upgrading to 22.9
I am getting back the same errors:

Code: Select all

Checking builds status
Build required. 


[ DefaultBuild ]
Building package: 
C:\Users\........Setup.exe
Prepare build
Detecting MSI incompatible resources
Preparing files
The digital signing of the APPDIR\arm64\......exe file failed. Error message: 'SignTool Error: No certificates were found that met all the given criteria.

For a possible solution please check our Digital Signature FAQ from:
https://www.advancedinstaller.com/user-guide/faq-digital-signature.html  '
Error details
 
Build finished because an error was encountered.

Has anything changed in 22.9? I am not able to ship an update to my product. Please help!

[Catalin]

Hello,

I'm checking the release notes and can't see much regarding this, except one point:

Screenshot_48.png (4.79 KiB) Viewed 2492 times

Are you still using a custom signtool and it still does not work?

Best regards,
Catalin

[nedumaran]

The problem was caused by Adv Installer defaulting to trial mode after the update. After fetching my license again, the signing went through without problems. Also, I am able to sign with arm64 signing tool in my arm64 machine - which I wasn't able to do before. This is a welcome fix. Thank you!

[Catalin]

You are always welcome!

Glad to hear everything is working as expected now.

Best regards,
Catalin