Where do you download signcode.exe and other tools

Question

If you decide to sign your code, you\'ll need:

• signcode.exe
• makecert.exe
• cert2spc.exe
• pvk2pfx.exe

What\'s the best place

Answer 1

I tried the method below and it worked, although it does NOT get you SignCode.exe (which has been deprecated and replaced by SignTool.exe)

You can get SignTool.exe by installing just the C++ Windows Development Tools from the Visual Studio install (mine is ancient: 2005). More details on that @ Lindersoft.com.

How to convert PFX/P12 file to SPC/PVK format

Export Certificate with Private Key.

Use the export wizard with the following options:

Export Private Key (Yes)

DO NOT TICK include all certificates in the certification path if possible

TICK enable strong protection

DO NOT TICK delete private key

Prerequisite: OpenSSL 0.9.8 or better. OpenSSL 1.x preferred.

Note: If you are running Windows you may download OpenSSL here. Otherwise, you can find compiled binaries directly from the OpenSSL Website or consult your Operating System's package management feature.

Private Key (PVK)

Extract your Private Key from the PFX/P12 file to PEM format.
     openssl pkcs12 -in PFX_FILE -nocerts -nodes -out PEM_KEY_FILE

Note: The PFX/P12 password will be asked. This is the password you gave the file upon exporting it.

Convert PEM Private Key to PVK format.

OpenSSL 0.9.8 series:
     pvk -in PEM_KEY_FILE -topvk -out PVK_FILE

OpenSSL 1.x series:
     openssl rsa -in PEM_KEY_FILE -outform PVK -pvk-strong -out PVK_FILE

Note #1: In order to use pvk for OpenSSL 0.9.8 series, you must download PVK Transform.

Note #2: A PEM passphrase may be asked. This will be the password/passphrase that you will use to sign your code.

Software Publisher's Certificate (SPC)

Extract Certificate from P12/PFX file.
     openssl pkcs12 -in PFX_FILE -nokeys -out CERT_PEM_FILE

Convert Certificate to SPC format.
     openssl crl2pkcs7 -nocrl -certfile CERT_PEM_FILE -outform DER -out SPC_FILE

Note: If you have exported your certificate from another browser outside of IE, then please ensure in the CERT_PEM_FILE that ONLY your certificate exists or else code signing will NOT WORK!

Example Conversion

PVK openssl pkcs12 -in my_pfx_file.pfx -nocerts -nodes -out rsa.pem openssl rsa -in rsa.pem -outform PVK -pvk-strong -out mykey.pvk

SPC openssl pkcs12 -in my_pfx_file.pfx -nokeys -nodes -out cert.pem openssl crl2pkcs7 -nocrl -certfile cert.pem -outform DER -out cert.spc

This information courtesy of Komodo.