How do I sign an .msi with a Thawte Code Signing certificate?

Question

Programming

Hello!

Can anyone help me understand how to sign an .msi file with a Thawte Code Signing certificate?

I have a private.key, they sent from Thawte: Code Signing certificate, intermediate CA certificate, certificate in pkcs7 format

What to do with this stuff? Thank you!

Answer 1

Google says to use signtool
From key and certificate you can build p12 or pfx (it's the same thing)

openssl pkcs12 -export -in input.crt -inkey input.key -out bundle.p12

Well, then follow the description www.hanselman.com/blog/UsingCodeSigningCertificatesToSignDownloadedMSIsAndBuildReputationWithIE9SmartScreen.aspx

Answer 2

Give the result of the command

certutil -verify -urlfetch <файл конечного сертификата в формате PEM>

Answer 3

Missing Issuer: CN=Thawte Code Signing CA — G2, O=«Thawte, Inc.», C=US

You need to add this certificate to the Intermediate certificate store. Your question is "intermediate CA certificate"
Run mmc as administrator, add the certificates snap-in (Add/Remove Snap-In -> Cerificates), then import the certificate CN=Thawte Code Signing CA — G2, O=«Thawte, Inc.», C=USinto the intermediate certificate store and try again.
It also looks like on your computer, where you check the certificate, the Internet is covered, or go through a proxy. For CryptoAPI, which is used by the certutil command, proxy settings are configured separately.

Answer 4

Well, this is nonsense, it has nothing to do with the validity of the certificate. These are settings for the Windows SmartScreen filter, such as notify about infrequently downloaded programs.
It is important that the publisher is visible, there are no complaints about the signature.

Answer 5

Here is how to deal with it .