วิธี Sign File สำหรับ Code Signing Certificate ด้วย SignTool ใน Windows

วิธี Sign File สำหรับ Code Signing Certificate ด้วย SignTool ใน Windows

ท่านสามารถทำการ Import Code Signing Certificate และ Sign File ด้วย DigiCertUtil.exe
โดยสามารถดูวิธีดำเนินการดังนี้ https://www.ireallyhost.com/kb/ssl/458

Timestamp ของ Code Signing Certificate  ยี่ห้อ DigiCert , GeoTrust, Thawte

http://timestamp.digicert.com

Timestamp ของ Code Signing Certificate  ยี่ห้อ COMODO , Sectigo

http://timestamp.sectigo.com

วิธี Sign file ด้วย SignTool

The following command adds the catalog file MyCatalogFileName.cat to the system component and driver database. The /u option generates a unique name if necessary to prevent replacing an existing catalog file named MyCatalogFileName.cat

signtool catdb /v /u MyCatalogFileName.cat  

The following command signs a file automatically by using the best certificate.

signtool sign /a /fd SHA256 MyFile.exe 

The following command digitally signs a file by using a certificate stored in a password-protected PFX file.

signtool sign /f MyCert.pfx /p MyPassword /fd SHA256 MyFile.exe 

The following command digitally signs and time-stamps a file. The certificate used to sign the file is stored in a PFX file.

signtool sign /f MyCert.pfx /t http://timestamp.digicert.com /fd SHA256 MyFile.exe 

The following command signs a file by using a certificate located in the
My store that has a subject name of  My Company Certificate

signtool sign /n "My Company Certificate" /fd SHA256 MyFile.exe 

The following command signs an ActiveX control and provides information that is displayed by Internet Explorer when the user is prompted to install the control.

Signtool sign /f MyCert.pfx /d: "MyControl" /du http://www.example.com/MyControl/info.html /fd SHA256 MyControl.exe 

The following command time-stamps a file that has already been digitally signed.

signtool timestamp /t http://timestamp.digicert.com MyFile.exe

The following command time-stamps a file using an RFC 3161 timestamp server.

Code Signing Certificate  ยี่ห้อ DigiCert , GeoTrust, Thawte

signtool timestamp /tr http://timestamp.digicert.com /td SHA256 MyFile.exe

Code Signing Certificate  ยี่ห้อ 

signtool timestamp /tr http://timestamp.sectigo.com /td SHA256 MyFile.exe

The following command verifies that a file has been signed.

signtool verify MyFile.exe  

The following command verifies a system file that may be signed in a catalog.

signtool verify /a SystemFile.dll  

The following command verifies a system file that is signed in a catalog named MyCatalog.cat

signtool verify /c MyCatalog.cat SystemFile.dll  

รายละเอียดเพิ่มเติม
https://docs.microsoft.com/th-th/windows/win32/seccrypto/signtool?redirectedfrom=MSDN