Digital Signatures and Timestamp with SSL Certificates

[Tardis]

Thanks Tlem,

Thats the one I used  NET Framework 2.0  maybe that's why its not working correctly the file names are different due to the file name need changing I will re run this bit again ..

If you want to make your selfcert, you can extract these files too :

FL_makecert_exe_____X86.3643236F_FC70_11D3_A536_0090278A1BB8  and rename it makecert.exe

FL_cert2spc_exe_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 and rename it cert2spc.exe
FL_certmgr_exe_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 and rename it certmgr.exe

I do have my Cert though the problems now is signing the exe  .

Edited August 12, 2014 by Tardis

[Tardis]

I found this and may be helpful and it works on my exe is now signed

signtool.exe sign /p "PASSWORD" /v /f "MY-PFX.pfx" -t "http://timestamp.verisign.com/scripts/timstamp.dll" "MY-EXE.exe"

 

BUT the UAC still says UNKNOWN publisher

Need a   Please

[Jon]

It's a real certificate from an external CA, right?

[Tardis]

No its my own and I added to my trust list   I think I understand now why need pay $$ to get one from CA   - No problem at least it works

[mLipok]

I modified this script.
Here is my result:

expandcollapse popup

#AutoIt3Wrapper_Run_AU3Check=Y
#AutoIt3Wrapper_Au3Check_Parameters=-d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6 -w 7
#AutoIt3Wrapper_UseX64=N ; CAPICOM is a 32-bit only component

;~ https://www.autoitscript.com/forum/topic/129720-digital-signatures-and-timestamp-with-ssl-certificates

; https://docs.microsoft.com/en-us/windows/win32/seccrypto/signer-options
; https://docs.microsoft.com/en-us/windows/win32/seccrypto/capicom-certificate-include-option
Global Const $CAPICOM_CERTIFICATE_INCLUDE_CHAIN_EXCEPT_ROOT = 0  ; Saves all certificates in the chain with the exception of the root entity.
Global Const $CAPICOM_CERTIFICATE_INCLUDE_WHOLE_CHAIN = 1  ; Saves the complete certificate chain.
Global Const $CAPICOM_CERTIFICATE_INCLUDE_END_ENTITY_ONLY = 2  ; Saves only the end entity certificate.

_Example()
Exit 0

Func _Example()
    Local $s_FileFullPath_ToSign
    If $CmdLine[0] < 1 Then
        $s_FileFullPath_ToSign = FileSaveDialog('Select File', @ScriptDir, "All (*.*)")
    Else
        $s_FileFullPath_ToSign = $CmdLine[1]
    EndIf
    _SignFile($s_FileFullPath_ToSign, "CERTIFICATE.pfx", 'PASSWORD', 'SOME DESCRIPTION')
EndFunc   ;==>_Example


Func _SignFile($s_FileFullPath_ToSign, $s_FileFullPath_Certificat, $s_Password, $s_Description = '')
    ConsoleWrite("> Signing file with this following parameters:" & @CRLF)
    ConsoleWrite("> 1= " & $s_FileFullPath_ToSign & @CRLF)
    If Not FileExists($s_FileFullPath_ToSign) Then
        ConsoleWrite("!    NOT EXIST" & @CRLF)
        Exit 1
    EndIf
    ConsoleWrite("> 2= " & $s_FileFullPath_Certificat & @CRLF)
    If Not FileExists($s_FileFullPath_Certificat) Then
        ConsoleWrite("!    NOT EXIST" & @CRLF)
        Exit 2
    EndIf
    ConsoleWrite("> 3= " & StringLen($s_Password) & @CRLF)
    ConsoleWrite("> 4= " & $s_Description & @CRLF)

    Local $oError = ObjEvent("AutoIt.Error", _COM_ErrorHandler_for_Signer) ; Initialize Error Handler
    #forceref $oError

    ; Create COM objects
    ; https://docs.microsoft.com/en-us/windows/win32/seccrypto/signedcode
    Local $oSignerCode = ObjCreate("CAPICOM.SignedCode.1")

    ; https://docs.microsoft.com/en-us/windows/win32/seccrypto/signedcode-signer
    ; https://docs.microsoft.com/en-us/windows/win32/seccrypto/signer
    Local $oSigner = ObjCreate("CAPICOM.Signer.1")

    ; Load certificate - Who Is Signing
    $oSigner.Load($s_FileFullPath_Certificat, $s_Password)

    ; https://docs.microsoft.com/en-us/windows/win32/seccrypto/signer-options
    ; $oSigner.Options = $CAPICOM_CERTIFICATE_INCLUDE_CHAIN_EXCEPT_ROOT


    #Region - Sign it
    $oSignerCode.FileName = $s_FileFullPath_ToSign
    If $s_Description = Default Then $s_Description = InputBox("Description", "Add a Description.. EX.. My Project Name v.01")
    If Not $s_Description = "" Then $oSignerCode.Description = $s_Description
    $oSignerCode.Sign($oSigner)
    ; TimeStampIt
    $oSignerCode.Timestamp("http://timestamp.verisign.com/scripts/timestamp.dll")
    #EndRegion - Sign it

    ; CleanUp - Clear Memory
    $oSignerCode = ""
    $oSigner = ""

EndFunc   ;==>_SignFile

Func _COM_ErrorHandler_for_Signer(ByRef $oError)
    Local $HexNumber = Hex($oError.number, 8)
    ConsoleWrite("! " & "Signer intercept COM Error" & @CRLF)
    ConsoleWrite("! " & "  $oError.description is: " & @TAB & $oError.description & @CRLF)
    ConsoleWrite("! " & "  $oError.windescription:" & @TAB & $oError.windescription & @CRLF)
    ConsoleWrite("! " & "  $oError.number is: " & @TAB & $HexNumber & @CRLF)
    ConsoleWrite("! " & "  $oError.lastdllerror is: " & @TAB & $oError.lastdllerror & @CRLF)
    ConsoleWrite("! " & "  $oError.scriptline is: " & @TAB & $oError.scriptline & @CRLF)
    ConsoleWrite("! " & "  $oError.source is: " & @TAB & $oError.source & @CRLF)
    ConsoleWrite("! " & "  $oError.helpfile is: " & @TAB & $oError.helpfile & @CRLF)
    ConsoleWrite("! " & "  $oError.helpcontext is: " & @TAB & $oError.helpcontext & @CRLF)
    Exit 20
EndFunc   ;==>_COM_ErrorHandler_for_Signer

 

EDIT 1:

I just tried this on second computer (latop), and I get into trouble. So I also read:
https://docs.microsoft.com/en-us/windows/win32/seccrypto/getting-ready-to-use-capicom

And if you get (just like I on my laptop)

Quote

$oError.windescription:    Nieprawidłowy ciąg klasy.
$oError.number is:     800401F3

or:

Quote

$oError.windescription:    Klasa niezarejestrowana.
$oError.number is:     80040154

To fix this you should download: 
Platform SDK Redistributable: CAPICOM
https://www.microsoft.com/en-us/download/details.aspx?id=25281

And register:
regsvr32 "c:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2 SDK\Lib\X86\capicom.dll"
 

 

EDIT 2:

according to:

https://docs.microsoft.com/en-us/windows/win32/seccrypto/getting-ready-to-use-capicom

Quote

CAPICOM is a 32-bit only component

 

so the script must use 32Bit AutoIt so I added:

#AutoIt3Wrapper_UseX64=N

 

Edited May 16, 2020 by mLipok

[boomingranny]

http://timestamp.verisign.com/scripts/timestamp.dll

Isn't working for timestamping for me anymore.
Error information: "SignerTimeStamp() failed." (-2147012867/0x80072efd)
Is anyone else having the same issue? Or is it a firewall/proxy issue at my end?

[mLipok]

https://stackoverflow.com/questions/9714798/http-timestamp-verisign-com-scripts-timstamp-dll-not-available

Quote

Honestly, I would just try again. But you can use any of the following:

• http://timestamp.globalsign.com/scripts/timstamp.dll,
• http://timestamp.comodoca.com/authenticode, or
• http://www.startssl.com/timestamp.
• http://timestamp.sectigo.com

or

Quote

Try these servers

http://tsa.starfieldtech.com
http://timestamp.globalsign.com/scripts/timstamp.dll
http://timestamp.comodoca.com/authenticode
http://www.startssl.com/timestamp
http://timestamp.verisign.com/scripts/timstamp.dll
http://timestamp.sectigo.com

 

[youtuber]

@mLipok  I can't not download sdk for use capicom.dll

https://www.microsoft.com/en-us/download/details.aspx?id=25281

Couldn't find an alternative microsoft official download address

 

[argumentum]

I believe the file is in that zip.

[youtuber]

@argumentum It is giving this error for me how can I fix it?

Error information: "SignerTimeStamp() failed." (-2147024895/0x80070001)
SignTool Error: An error occurred while attempting to timestamp: C:\Users\USER\Desktop\CertSigner[2016.07.01b]\Test.exe

SignTool Error: An unexpected internal error has occurred.

https://prnt.sc/11w8ii1

[argumentum]

wow, I see it too on my side. Have not used this in a while. I'd have to "get into it" but don't have the time to investigate. At least it has the file you were trying to get.
Maybe is just the servers. I'll try a new server from mLipok's list
use this url: 

http://timestamp.digicert.com/scripts/timestamp.dll

I recompiled with the above replacing the old one and it worked