如何在没有用户交互的情况下在 Windows10 中创建和安装 X.509 自签名证书？
How to create and install X.509 self signed certificates in Windows 10 without user interaction?
问题
- 创建并安装 个要签署的临时证书
我的开发环境中的代码。
- 这必须在 无人看管的情况下完成
脚本（无需用户交互）。
遗留脚本
现在，我有这个使用 deprecated tool makecert:
创建证书的脚本
makecert -r -pe -n "CN=My CA" -ss CA -sr CurrentUser -a sha256 -cy authority -sky signature -sv MyCA.pvk MyCA.cer
certutil -user -addstore Root MyCA.cer
certutil -addstore Root MyCA.cer
makecert -pe -n "CN=My Company" -a sha256 -cy end -sky signature -ic MyCA.cer -iv MyCA.pvk -sv MySPC.pvk MySPC.cer
pvk2pfx.exe -pvk MySPC.pvk -spc MySPC.cer -pfx MySPC.pfx
certutil -f -user -p "" -importPFX MySPC.pfx
以上脚本创建了 2 个证书：
MyCA.cer: 自签名根授权证书。MySPC.cer：用于签署我的代码的证书（使用 MyCA.cer 签名）。
此脚本还会打开对话框，请求用户密码和用户确认，以便在受信任的根证书颁发机构存储中安装证书。 我需要在没有用户交互的情况下完成此操作。
新脚本
在 this instructions 之后，我用 powershell cmdlet New-SelfSignedCertificate 重写了遗留脚本。这是我试过的：
# Create a self-signed root authority certificate.
$rootCert = New-SelfSignedCertificate -KeyExportPolicy Exportable -CertStoreLocation cert:\CurrentUser\My -DnsName "Development Root CA" -NotAfter (Get-Date).AddYears(5) -KeyusageProperty All -KeyUsage CertSign,CRLSign,DigitalSignature
# Export the root authority private key.
[System.Security.SecureString] $password = ConvertTo-SecureString -String "passwordx" -Force -AsPlainText
[String] $rootCertPath = Join-Path -Path cert:\CurrentUser\My\ -ChildPath "$($rootcert.Thumbprint)"
Export-PfxCertificate -Cert $rootCertPath -FilePath "MyCA.pfx" -Password $password
Export-Certificate -Cert $rootCertPath -FilePath "MyCA.crt"
# Create a "MySPC" certificate signed by our root authority.
$cert = New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName "MySPC" -TextExtension @("2.5.29.19={text}false") -KeyLength 2048 -Signer $rootCert -Type CodeSigningCert -KeyUsage None
# Save the signed certificate with private key into a PFX file and just the public key into a CRT file.
[String] $certPath = Join-Path -Path cert:\LocalMachine\My\ -ChildPath "$($cert.Thumbprint)"
Export-PfxCertificate -Cert $certPath -FilePath MySPC.pfx -Password $password
Export-Certificate -Cert $certPath -FilePath "MySPC.crt"
# Add MyCA certificate to the Trusted Root Certification Authorities.
$pfx = new-object System.Security.Cryptography.X509Certificates.X509Certificate2
$pfx.import("MyCA.pfx", $password, "Exportable,PersistKeySet")
$store = new-object System.Security.Cryptography.X509Certificates.X509Store(
[System.Security.Cryptography.X509Certificates.StoreName]::Root,
"localmachine"
)
$store.open("MaxAllowed")
$store.add($pfx)
$store.close()
# Import certificate.
Import-PfxCertificate -FilePath MySPC.pfx cert:\CurrentUser\My -Password $password
新脚本无需用户交互即可创建和安装 MyCA.cer 和 MySPC.cer，但这些证书与以前的不同。例如，当我查看 MyCA.cer 时，预期目的是：
Proves your identity to a remote computer
Ensures the identity of a remote computer
All issuance policies
而不是预期的：
All issuance policies
All application policies
其他问题
使用 makecert 创建的证书具有基本约束：
Subject Type=CA，但我无法使用创建此类约束
New-SelfSignedCertificate.
最后，MySPC.cer 无法签署我的代码，它失败了
错误如“对所选目的无效”。
问题
如何以无人值守的方式生成与遗留脚本相同的证书？
提前致谢。
编辑
根据 Mötz 提出的更改，我可以签名，但在验证时出现错误。这些是命令：
签署命令
signtool.exe sign /v /a c:\git\...\Win32\det.dll
The following certificate was selected:
Issued to: XXXXXXXXXX
Issued by: My CA
Expires: Fri Dec 20 20:18:26 2019
SHA1 hash: 0440F2B76E5BBF1F9CB4D24EF5E5AA54F4F4C2E1
Done Adding Additional Store
Successfully signed: c:\git\...\Win32\det.dll
Number of files successfully Signed: 1
Number of warnings: 0
Number of errors: 0
验证命令
signtool.exe verify /pa /v c:\git\...\Win32\det.dll
Signature Index: 0 (Primary Signature)
Hash of file (sha1): E4EC8126CC9510610AF4FC72CC8722B81B171AE1
Signing Certificate Chain:
Issued to: My CA
Issued by: My CA
Expires: Thu Dec 21 01:14:52 2023
SHA1 hash: DA5B1972016D66294886CA3EDA2D4FEF245D7337
Issued to: XXXXXXXXX
Issued by: My CA
Expires: Sat Dec 21 01:24:53 2019
SHA1 hash: 3316486BAF0A53C1C3227F1E522FF776B6F32CC9
File is not timestamped.
SignTool Error: The signing certificate is not valid for the requested usage.
Number of files successfully Verified: 0
Number of warnings: 0
Number of errors: 1
解决方案
公认的解决方案包括解决问题的所有关键事项（非常感谢 Mötz）。为了帮助其他人，我对最终脚本进行了一些小改动。
#
# This script will create and install two certificates:
# 1. `MyCA.cer`: A self-signed root authority certificate.
# 2. `MySPC.cer`: The cerificate to sign code in
# a development environment (signed with `MyCA.cer`).
#
# No user interaction is needed (unattended).
# Powershell 4.0 or higher is required.
#
# Define the expiration date for certificates.
$notAfter = (Get-Date).AddYears(10)
# Create a self-signed root Certificate Authority (CA).
$rootCert = New-SelfSignedCertificate -KeyExportPolicy Exportable -CertStoreLocation Cert:\CurrentUser\My -DnsName "My CA" -NotAfter $notAfter -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3", "2.5.29.19={text}CA=1") -KeyusageProperty All -KeyUsage CertSign, CRLSign, DigitalSignature
# Export the CA private key.
[System.Security.SecureString] $password = ConvertTo-SecureString -String "passwordx" -Force -AsPlainText
[String] $rootCertPath = Join-Path -Path cert:\CurrentUser\My\ -ChildPath "$($rootcert.Thumbprint)"
Export-PfxCertificate -Cert $rootCertPath -FilePath "MyCA.pfx" -Password $password
Export-Certificate -Cert $rootCertPath -FilePath "MyCA.crt"
# Create an end certificate signed by our CA.
$cert = New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName "My Company Name" -NotAfter $notAfter -Signer $rootCert -Type CodeSigningCert -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3", "2.5.29.19={text}CA=0&pathlength=0")
# Save the signed certificate with private key into a PFX file and just the public key into a CRT file.
[String] $certPath = Join-Path -Path cert:\LocalMachine\My\ -ChildPath "$($cert.Thumbprint)"
Export-PfxCertificate -Cert $certPath -FilePath "MySPC.pfx" -Password $password
Export-Certificate -Cert $certPath -FilePath "MySPC.crt"
# Add MyCA certificate to the Trusted Root Certification Authorities.
$pfx = new-object System.Security.Cryptography.X509Certificates.X509Certificate2
$pfx.import("MyCA.pfx", $password, "Exportable,PersistKeySet")
$store = new-object System.Security.Cryptography.X509Certificates.X509Store(
[System.Security.Cryptography.X509Certificates.StoreName]::Root,
"localmachine"
)
$store.open("MaxAllowed")
$store.add($pfx)
$store.close()
# Remove MyCA from CurrentUser to avoid issues when signing with "signtool.exe /a ..."
Remove-Item -Force "cert:\CurrentUser\My$($rootCert.Thumbprint)"
# Import certificate.
Import-PfxCertificate -FilePath MySPC.pfx cert:\CurrentUser\My -Password $password -Exportable
通过证书传播服务在证书存储区安装证书。
所以你可以扫描（扫描API）Certificate Propagation服务并像它一样开发。
您可以使用 API 监视器。
我刚刚使用来自我的 Visual Studio 2017 安装的 signtool.exe 测试了您的代码，似乎一切正常。
所以我真的很想看看你用来签署文件的代码/命令。我更希望看到您所看到的错误的真实输出。您能否先手动/手动尝试您的签名过程，以便我们确定我们关注的是正确的问题？
话虽如此，我还是花了一些时间四处挖掘，以回答您提出的其他一些问题。
解决你只想看的第一部分
All issuance policies
All application policies
这是通过 TextExtension 参数解决的：
-TextExtension @("2.5.29.37={text}1.3.6.1.4.1.311.10.12.1")
正在解决您想要
的部分
Subject Type = CA
这是通过 TextExtension 参数解决的：
-TextExtension @("2.5.29.19={text}CA=1&pathlength=3")
路径长度用于限制children可以使用证书的级别。请阅读更多 here。值 3 只是测试时使用的东西。
然后我们需要组合这 2 个不同的 TextExtensions 条目：
-TextExtension @("2.5.29.37={text}1.3.6.1.4.1.311.10.12.1", "2.5.29.19={text}CA=1&pathlength=3")
这将使我们像这样编写更新的脚本
$rootCert = New-SelfSignedCertificate -KeyExportPolicy Exportable -CertStoreLocation cert:\CurrentUser\My -DnsName "Development Root CA" -NotAfter (Get-Date).AddYears(5) -TextExtension @("2.5.29.37={text}1.3.6.1.4.1.311.10.12.1", "2.5.29.19={text}CA=1&pathlength=3") -KeyusageProperty All -KeyUsage CertSign,CRLSign,DigitalSignature
# Export the root authority private key.
[System.Security.SecureString] $password = ConvertTo-SecureString -String "passwordx" -Force -AsPlainText
[String] $rootCertPath = Join-Path -Path cert:\CurrentUser\My\ -ChildPath "$($rootcert.Thumbprint)"
Export-PfxCertificate -Cert $rootCertPath -FilePath "MyCA.pfx" -Password $password
Export-Certificate -Cert $rootCertPath -FilePath "MyCA.crt"
# Create a "MySPC" certificate signed by our root authority.
$cert = New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName "MySPC" -Signer $rootCert -Type CodeSigningCert
# Save the signed certificate with private key into a PFX file and just the public key into a CRT file.
[String] $certPath = Join-Path -Path cert:\LocalMachine\My\ -ChildPath "$($cert.Thumbprint)"
Export-PfxCertificate -Cert $certPath -FilePath MySPC.pfx -Password $password
Export-Certificate -Cert $certPath -FilePath "MySPC.crt"
# Add MyCA certificate to the Trusted Root Certification Authorities.
$pfx = new-object System.Security.Cryptography.X509Certificates.X509Certificate2
$pfx.import("MyCA.pfx", $password, "Exportable,PersistKeySet")
$store = new-object System.Security.Cryptography.X509Certificates.X509Store(
[System.Security.Cryptography.X509Certificates.StoreName]::Root,
"localmachine"
)
$store.open("MaxAllowed")
$store.add($pfx)
$store.close()
# Import certificate.
Import-PfxCertificate -FilePath MySPC.pfx cert:\CurrentUser\My -Password $password
但正如我之前所说，您的代码似乎生成了正确的证书，因为我能够使用它生成的证书并使用它签署 .net EXE 文件。
签约前
签约
SignTool sign /n "MySPC" 2LCS.exe
签约后
根据新信息更新
您需要在验证命令中指定 /pa 开关。
https://knowledge.digicert.com/solution/SO21771.html
https://docs.microsoft.com/en-us/windows/desktop/seccrypto/signtool
问题是您是否会看到与 makecert 证书相同的情况？
更新了工作代码
你对证书属性的关注让我误入歧途。根据 here 的讨论，我了解到我们 可能 需要将其创建为 Class 3 代码签名。我删除了 1.3.6.1.4.1.311.10.12.1 EKU 扩展并将其替换为 1.3.6.1.5.5.7.3.3。请参阅下面的代码示例。
$rootCert = New-SelfSignedCertificate -KeyExportPolicy Exportable -CertStoreLocation cert:\CurrentUser\My -DnsName "Development Root CA" -NotAfter (Get-Date).AddYears(5) -TextExtension @("2.5.29.19={text}CA=1&pathlength=3", "2.5.29.37={text}1.3.6.1.5.5.7.3.3") -KeyusageProperty All -KeyUsage CertSign,CRLSign,DigitalSignature #-Type CodeSigningCert
# Export the root authority private key.
[System.Security.SecureString] $password = ConvertTo-SecureString -String "passwordx" -Force -AsPlainText
[String] $rootCertPath = Join-Path -Path cert:\CurrentUser\My\ -ChildPath "$($rootcert.Thumbprint)"
Export-PfxCertificate -Cert $rootCertPath -FilePath "MyCA.pfx" -Password $password
Export-Certificate -Cert $rootCertPath -FilePath "MyCA.crt"
# Create a "MySPC" certificate signed by our root authority.
$cert = New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName "MySPC" -Signer $rootCert -Type CodeSigningCert
# Save the signed certificate with private key into a PFX file and just the public key into a CRT file.
[String] $certPath = Join-Path -Path cert:\LocalMachine\My\ -ChildPath "$($cert.Thumbprint)"
Export-PfxCertificate -Cert $certPath -FilePath MySPC.pfx -Password $password
Export-Certificate -Cert $certPath -FilePath "MySPC.crt"
# Add MyCA certificate to the Trusted Root Certification Authorities.
$pfx = new-object System.Security.Cryptography.X509Certificates.X509Certificate2
$pfx.import("MyCA.pfx", $password, "Exportable,PersistKeySet")
$store = new-object System.Security.Cryptography.X509Certificates.X509Store(
[System.Security.Cryptography.X509Certificates.StoreName]::Root,
"localmachine"
)
$store.open("MaxAllowed")
$store.add($pfx)
$store.close()
# Import certificate.
Import-PfxCertificate -FilePath MySPC.pfx cert:\CurrentUser\My -Password $password
我运行以下签名命令：
然后我运行验证命令：
有了这些，我相信您应该有一个可行的解决方案。请对其进行测试、验证，然后对其进行扩展以包括您的时间戳签名。
问题
- 创建并安装 个要签署的临时证书 我的开发环境中的代码。
- 这必须在 无人看管的情况下完成 脚本（无需用户交互）。
遗留脚本
现在，我有这个使用 deprecated tool makecert:
创建证书的脚本makecert -r -pe -n "CN=My CA" -ss CA -sr CurrentUser -a sha256 -cy authority -sky signature -sv MyCA.pvk MyCA.cer
certutil -user -addstore Root MyCA.cer
certutil -addstore Root MyCA.cer
makecert -pe -n "CN=My Company" -a sha256 -cy end -sky signature -ic MyCA.cer -iv MyCA.pvk -sv MySPC.pvk MySPC.cer
pvk2pfx.exe -pvk MySPC.pvk -spc MySPC.cer -pfx MySPC.pfx
certutil -f -user -p "" -importPFX MySPC.pfx
以上脚本创建了 2 个证书：
MyCA.cer: 自签名根授权证书。MySPC.cer：用于签署我的代码的证书（使用MyCA.cer签名）。
此脚本还会打开对话框，请求用户密码和用户确认，以便在受信任的根证书颁发机构存储中安装证书。 我需要在没有用户交互的情况下完成此操作。
新脚本
在 this instructions 之后，我用 powershell cmdlet New-SelfSignedCertificate 重写了遗留脚本。这是我试过的：
# Create a self-signed root authority certificate.
$rootCert = New-SelfSignedCertificate -KeyExportPolicy Exportable -CertStoreLocation cert:\CurrentUser\My -DnsName "Development Root CA" -NotAfter (Get-Date).AddYears(5) -KeyusageProperty All -KeyUsage CertSign,CRLSign,DigitalSignature
# Export the root authority private key.
[System.Security.SecureString] $password = ConvertTo-SecureString -String "passwordx" -Force -AsPlainText
[String] $rootCertPath = Join-Path -Path cert:\CurrentUser\My\ -ChildPath "$($rootcert.Thumbprint)"
Export-PfxCertificate -Cert $rootCertPath -FilePath "MyCA.pfx" -Password $password
Export-Certificate -Cert $rootCertPath -FilePath "MyCA.crt"
# Create a "MySPC" certificate signed by our root authority.
$cert = New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName "MySPC" -TextExtension @("2.5.29.19={text}false") -KeyLength 2048 -Signer $rootCert -Type CodeSigningCert -KeyUsage None
# Save the signed certificate with private key into a PFX file and just the public key into a CRT file.
[String] $certPath = Join-Path -Path cert:\LocalMachine\My\ -ChildPath "$($cert.Thumbprint)"
Export-PfxCertificate -Cert $certPath -FilePath MySPC.pfx -Password $password
Export-Certificate -Cert $certPath -FilePath "MySPC.crt"
# Add MyCA certificate to the Trusted Root Certification Authorities.
$pfx = new-object System.Security.Cryptography.X509Certificates.X509Certificate2
$pfx.import("MyCA.pfx", $password, "Exportable,PersistKeySet")
$store = new-object System.Security.Cryptography.X509Certificates.X509Store(
[System.Security.Cryptography.X509Certificates.StoreName]::Root,
"localmachine"
)
$store.open("MaxAllowed")
$store.add($pfx)
$store.close()
# Import certificate.
Import-PfxCertificate -FilePath MySPC.pfx cert:\CurrentUser\My -Password $password
新脚本无需用户交互即可创建和安装 MyCA.cer 和 MySPC.cer，但这些证书与以前的不同。例如，当我查看 MyCA.cer 时，预期目的是：
Proves your identity to a remote computer
Ensures the identity of a remote computer
All issuance policies
而不是预期的：
All issuance policies
All application policies
其他问题
使用
makecert创建的证书具有基本约束：Subject Type=CA，但我无法使用创建此类约束New-SelfSignedCertificate.最后，
MySPC.cer无法签署我的代码，它失败了 错误如“对所选目的无效”。
问题
如何以无人值守的方式生成与遗留脚本相同的证书？
提前致谢。
编辑
根据 Mötz 提出的更改，我可以签名，但在验证时出现错误。这些是命令：
签署命令
signtool.exe sign /v /a c:\git\...\Win32\det.dll
The following certificate was selected:
Issued to: XXXXXXXXXX
Issued by: My CA
Expires: Fri Dec 20 20:18:26 2019
SHA1 hash: 0440F2B76E5BBF1F9CB4D24EF5E5AA54F4F4C2E1
Done Adding Additional Store
Successfully signed: c:\git\...\Win32\det.dll
Number of files successfully Signed: 1
Number of warnings: 0
Number of errors: 0
验证命令
signtool.exe verify /pa /v c:\git\...\Win32\det.dll
Signature Index: 0 (Primary Signature)
Hash of file (sha1): E4EC8126CC9510610AF4FC72CC8722B81B171AE1
Signing Certificate Chain:
Issued to: My CA
Issued by: My CA
Expires: Thu Dec 21 01:14:52 2023
SHA1 hash: DA5B1972016D66294886CA3EDA2D4FEF245D7337
Issued to: XXXXXXXXX
Issued by: My CA
Expires: Sat Dec 21 01:24:53 2019
SHA1 hash: 3316486BAF0A53C1C3227F1E522FF776B6F32CC9
File is not timestamped.
SignTool Error: The signing certificate is not valid for the requested usage.
Number of files successfully Verified: 0
Number of warnings: 0
Number of errors: 1
解决方案
公认的解决方案包括解决问题的所有关键事项（非常感谢 Mötz）。为了帮助其他人，我对最终脚本进行了一些小改动。
#
# This script will create and install two certificates:
# 1. `MyCA.cer`: A self-signed root authority certificate.
# 2. `MySPC.cer`: The cerificate to sign code in
# a development environment (signed with `MyCA.cer`).
#
# No user interaction is needed (unattended).
# Powershell 4.0 or higher is required.
#
# Define the expiration date for certificates.
$notAfter = (Get-Date).AddYears(10)
# Create a self-signed root Certificate Authority (CA).
$rootCert = New-SelfSignedCertificate -KeyExportPolicy Exportable -CertStoreLocation Cert:\CurrentUser\My -DnsName "My CA" -NotAfter $notAfter -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3", "2.5.29.19={text}CA=1") -KeyusageProperty All -KeyUsage CertSign, CRLSign, DigitalSignature
# Export the CA private key.
[System.Security.SecureString] $password = ConvertTo-SecureString -String "passwordx" -Force -AsPlainText
[String] $rootCertPath = Join-Path -Path cert:\CurrentUser\My\ -ChildPath "$($rootcert.Thumbprint)"
Export-PfxCertificate -Cert $rootCertPath -FilePath "MyCA.pfx" -Password $password
Export-Certificate -Cert $rootCertPath -FilePath "MyCA.crt"
# Create an end certificate signed by our CA.
$cert = New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName "My Company Name" -NotAfter $notAfter -Signer $rootCert -Type CodeSigningCert -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3", "2.5.29.19={text}CA=0&pathlength=0")
# Save the signed certificate with private key into a PFX file and just the public key into a CRT file.
[String] $certPath = Join-Path -Path cert:\LocalMachine\My\ -ChildPath "$($cert.Thumbprint)"
Export-PfxCertificate -Cert $certPath -FilePath "MySPC.pfx" -Password $password
Export-Certificate -Cert $certPath -FilePath "MySPC.crt"
# Add MyCA certificate to the Trusted Root Certification Authorities.
$pfx = new-object System.Security.Cryptography.X509Certificates.X509Certificate2
$pfx.import("MyCA.pfx", $password, "Exportable,PersistKeySet")
$store = new-object System.Security.Cryptography.X509Certificates.X509Store(
[System.Security.Cryptography.X509Certificates.StoreName]::Root,
"localmachine"
)
$store.open("MaxAllowed")
$store.add($pfx)
$store.close()
# Remove MyCA from CurrentUser to avoid issues when signing with "signtool.exe /a ..."
Remove-Item -Force "cert:\CurrentUser\My$($rootCert.Thumbprint)"
# Import certificate.
Import-PfxCertificate -FilePath MySPC.pfx cert:\CurrentUser\My -Password $password -Exportable
通过证书传播服务在证书存储区安装证书。
所以你可以扫描（扫描API）Certificate Propagation服务并像它一样开发。
您可以使用 API 监视器。
我刚刚使用来自我的 Visual Studio 2017 安装的 signtool.exe 测试了您的代码，似乎一切正常。
所以我真的很想看看你用来签署文件的代码/命令。我更希望看到您所看到的错误的真实输出。您能否先手动/手动尝试您的签名过程，以便我们确定我们关注的是正确的问题？
话虽如此，我还是花了一些时间四处挖掘，以回答您提出的其他一些问题。
解决你只想看的第一部分
All issuance policies
All application policies
这是通过 TextExtension 参数解决的：
-TextExtension @("2.5.29.37={text}1.3.6.1.4.1.311.10.12.1")
正在解决您想要
的部分Subject Type = CA
这是通过 TextExtension 参数解决的：
-TextExtension @("2.5.29.19={text}CA=1&pathlength=3")
路径长度用于限制children可以使用证书的级别。请阅读更多 here。值 3 只是测试时使用的东西。
然后我们需要组合这 2 个不同的 TextExtensions 条目：
-TextExtension @("2.5.29.37={text}1.3.6.1.4.1.311.10.12.1", "2.5.29.19={text}CA=1&pathlength=3")
这将使我们像这样编写更新的脚本
$rootCert = New-SelfSignedCertificate -KeyExportPolicy Exportable -CertStoreLocation cert:\CurrentUser\My -DnsName "Development Root CA" -NotAfter (Get-Date).AddYears(5) -TextExtension @("2.5.29.37={text}1.3.6.1.4.1.311.10.12.1", "2.5.29.19={text}CA=1&pathlength=3") -KeyusageProperty All -KeyUsage CertSign,CRLSign,DigitalSignature
# Export the root authority private key.
[System.Security.SecureString] $password = ConvertTo-SecureString -String "passwordx" -Force -AsPlainText
[String] $rootCertPath = Join-Path -Path cert:\CurrentUser\My\ -ChildPath "$($rootcert.Thumbprint)"
Export-PfxCertificate -Cert $rootCertPath -FilePath "MyCA.pfx" -Password $password
Export-Certificate -Cert $rootCertPath -FilePath "MyCA.crt"
# Create a "MySPC" certificate signed by our root authority.
$cert = New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName "MySPC" -Signer $rootCert -Type CodeSigningCert
# Save the signed certificate with private key into a PFX file and just the public key into a CRT file.
[String] $certPath = Join-Path -Path cert:\LocalMachine\My\ -ChildPath "$($cert.Thumbprint)"
Export-PfxCertificate -Cert $certPath -FilePath MySPC.pfx -Password $password
Export-Certificate -Cert $certPath -FilePath "MySPC.crt"
# Add MyCA certificate to the Trusted Root Certification Authorities.
$pfx = new-object System.Security.Cryptography.X509Certificates.X509Certificate2
$pfx.import("MyCA.pfx", $password, "Exportable,PersistKeySet")
$store = new-object System.Security.Cryptography.X509Certificates.X509Store(
[System.Security.Cryptography.X509Certificates.StoreName]::Root,
"localmachine"
)
$store.open("MaxAllowed")
$store.add($pfx)
$store.close()
# Import certificate.
Import-PfxCertificate -FilePath MySPC.pfx cert:\CurrentUser\My -Password $password
但正如我之前所说，您的代码似乎生成了正确的证书，因为我能够使用它生成的证书并使用它签署 .net EXE 文件。
签约前
签约
SignTool sign /n "MySPC" 2LCS.exe
签约后
根据新信息更新
您需要在验证命令中指定 /pa 开关。
https://knowledge.digicert.com/solution/SO21771.html
https://docs.microsoft.com/en-us/windows/desktop/seccrypto/signtool
问题是您是否会看到与 makecert 证书相同的情况？
更新了工作代码
你对证书属性的关注让我误入歧途。根据 here 的讨论，我了解到我们 可能 需要将其创建为 Class 3 代码签名。我删除了 1.3.6.1.4.1.311.10.12.1 EKU 扩展并将其替换为 1.3.6.1.5.5.7.3.3。请参阅下面的代码示例。
$rootCert = New-SelfSignedCertificate -KeyExportPolicy Exportable -CertStoreLocation cert:\CurrentUser\My -DnsName "Development Root CA" -NotAfter (Get-Date).AddYears(5) -TextExtension @("2.5.29.19={text}CA=1&pathlength=3", "2.5.29.37={text}1.3.6.1.5.5.7.3.3") -KeyusageProperty All -KeyUsage CertSign,CRLSign,DigitalSignature #-Type CodeSigningCert
# Export the root authority private key.
[System.Security.SecureString] $password = ConvertTo-SecureString -String "passwordx" -Force -AsPlainText
[String] $rootCertPath = Join-Path -Path cert:\CurrentUser\My\ -ChildPath "$($rootcert.Thumbprint)"
Export-PfxCertificate -Cert $rootCertPath -FilePath "MyCA.pfx" -Password $password
Export-Certificate -Cert $rootCertPath -FilePath "MyCA.crt"
# Create a "MySPC" certificate signed by our root authority.
$cert = New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName "MySPC" -Signer $rootCert -Type CodeSigningCert
# Save the signed certificate with private key into a PFX file and just the public key into a CRT file.
[String] $certPath = Join-Path -Path cert:\LocalMachine\My\ -ChildPath "$($cert.Thumbprint)"
Export-PfxCertificate -Cert $certPath -FilePath MySPC.pfx -Password $password
Export-Certificate -Cert $certPath -FilePath "MySPC.crt"
# Add MyCA certificate to the Trusted Root Certification Authorities.
$pfx = new-object System.Security.Cryptography.X509Certificates.X509Certificate2
$pfx.import("MyCA.pfx", $password, "Exportable,PersistKeySet")
$store = new-object System.Security.Cryptography.X509Certificates.X509Store(
[System.Security.Cryptography.X509Certificates.StoreName]::Root,
"localmachine"
)
$store.open("MaxAllowed")
$store.add($pfx)
$store.close()
# Import certificate.
Import-PfxCertificate -FilePath MySPC.pfx cert:\CurrentUser\My -Password $password
我运行以下签名命令：
然后我运行验证命令：
有了这些，我相信您应该有一个可行的解决方案。请对其进行测试、验证，然后对其进行扩展以包括您的时间戳签名。