Microsoft Authenticode
Step 1: Download Signing Tools
The Platform SDK for Microsoft Windows contains the information and tools you
need to develop Windows-based applications. You can use this SDK to develop both
32- and 64-bit applications. Make sure that you are running the most current version
of the SDK.
Windows NT and Windows Me/98/95: SignTool.exe is not supported.
To download the software development kit (SDK) for Windows 2003/XP/2000, go to:
Microsoft Windows Server 2003 Platform SDK.
To install the minimal tools needed for signing your files only install the Tools and
Redistributable Components of the Microsoft Windows Core SDK.
Step 2: Signing Files
Windows 2003/XP/2000
To sign, you will use the SIGNTOOL.EXE utility included in the Platform SDK. You will
also need your Digital ID file (generally called MyCredentials.spc) and your private
key (MyPrivateKey.pvk).
Sign your File
The following steps will walk you through signing with the GUI.
Windows 2000/XP/2003
1. Go to Start > Run
2. Enter CMD
3. Click OK
Michal Buyum © Comsign Ltd
4. At the command prompt, enter C:\Program Files\Microsoft Platform SDK for
Windows Server 2003 R2\Bin
5. Hit the Enter key
6. Enter signtool signwizard
7. A wizard will appear. Click Next
Michal Buyum © Comsign Ltd
8. Browse to find the file you would like to digitally sign
9. Click Next
Michal Buyum © Comsign Ltd
10. Click Custom > Next
11. Click Select from File and locate your MyCredentials.spc file
12. Click Next
Michal Buyum © Comsign Ltd
13. Click Select from File and locate your MyPrivateKey.pvk file
14. Click Next
Michal Buyum © Comsign Ltd
15. Select sha1 and click Next twice
Michal Buyum © Comsign Ltd
16. If you would like you can now enter a description of your file and a web site
address where more information can be located, then click Next
17. Select Add a timestamp to the data and in the Timestamp Service URL enter:
http://timestamp.verisign.com/scripts/timstamp.dll
Note: "timstamp.dll" does not contain the letter "e"
Michal Buyum © Comsign Ltd
18. Click Next
19. Verify all of the information is correct and click Finish
20. You have successfully signed your file
Michal Buyum © Comsign Ltd
Test Your Signature
The Platform SDK SIGNTOOL.EXE utility contains a command to check a digital
signature before distributing your file.
1. Go to: Start > Run
2. Type CMD and click OK
3. At the command prompt, enter the directory where signtool exists
4. Type: signtool verify /pa /v <your-file-name>
Note: Replace <your-file-name> with the name of the file you signed
When a code signed file is downloaded from a Web site using Internet Explorer, it
will display this certificate to the user. If the file is tampered with in any way after it
has been signed, the user will be notified and given the option to refuse installation.
Michal Buyum © Comsign Ltd