SignTool Error: The signer's certificate is not valid for signing.

[Chaoses-Ib]

Without MagicSigner:

> signtool /fd certHash /sha1 94FAFF8199A580C9E55A11B11A510B09469D38EE test.exe
Done Adding Additional Store
Successfully signed: test.exe

With MagicSigner:

> signtool /fd certHash /sha1 94FAFF8199A580C9E55A11B11A510B09469D38EE test.exe
Done Adding Additional Store
SignTool Error: The signer's certificate is not valid for signing.
SignTool Error: An error occurred while attempting to sign: test.exe

Number of errors: 1

SignTool version: 10.0.26100.2454, binary: signtool.zip

[namazso]

I can't reproduce this, I grabbed the newest SDK with signtool 10.0.26100.3916 and it can still sign anything. Is there anything special about the cert you're trying?

[Chaoses-Ib]

After testing on other versions of signtool, I found the problem exist on all of them. So it's likely not related to the version.

Write-Host "With MagicSigner:"
mv .\XmlLite.dll* .\XmlLite.dll
cp rust-2025-01-31-msvc.exe test.exe
.\signtool.10.0.10586.212.exe sign /fd sha1 /f WDKTestCert.pfx /p 123 test.exe
.\signtool.10.0.22621.3233.exe sign /fd certHash /f WDKTestCert.pfx /p 123 test.exe
.\signtool.10.0.26100.2454.exe sign /fd certHash /f WDKTestCert.pfx /p 123 test.exe

Write-Host "Without MagicSigner:"
mv .\XmlLite.dll* .\XmlLite.dll.bak
cp rust-2025-01-31-msvc.exe test.exe
.\signtool.10.0.10586.212.exe sign /fd sha1 /f WDKTestCert.pfx /p 123 test.exe
.\signtool.10.0.22621.3233.exe sign /fd certHash /f WDKTestCert.pfx /p 123 test.exe
.\signtool.10.0.26100.2454.exe sign /fd certHash /f WDKTestCert.pfx /p 123 test.exe

With MagicSigner:
Done Adding Additional Store
SignTool Error: The signer's certificate is not valid for signing.
SignTool Error: An error occurred while attempting to sign: test.exe

Number of errors: 1
Done Adding Additional Store
SignTool Error: The signer's certificate is not valid for signing.
SignTool Error: An error occurred while attempting to sign: test.exe

Number of errors: 1
Done Adding Additional Store
SignTool Error: The signer's certificate is not valid for signing.
SignTool Error: An error occurred while attempting to sign: test.exe

Number of errors: 1
Without MagicSigner:
Done Adding Additional Store
Successfully signed: test.exe
Done Adding Additional Store
Successfully signed: test.exe
Done Adding Additional Store
Successfully signed: test.exe

The cert doesn't seem to be the reason either. I've tested two WDK test certs generated by VS (WDKTestCert.zip), the one leaked from NVIDIA and some others. All of them came with the same error.

I've also tested different exe, one Rust x64 MSVC, one C++ x64 MSVC, and one x86 VC6. All have the same result.

[namazso]

That's odd, I tested with the same nvidia cert. I wonder if this has something to do with your environment or OS version or something.

[Chaoses-Ib]

You're right. On 22000.3147 it works, but on 26100.3624 and 26100.3775 it doesn't. The two hooked DLL from 26100.3624 is here: 26100.3624.zip

[namazso]

Interesting, I just updated to 10.0.26100.3775 and it still works for me with latest (10.0.26100.3916) signtool. Even after deleting every combination of signtool.exe.manifest, wintrust.dll, and mssign32.dll from the SDK (to force it to use the system one)

[Chaoses-Ib]

FYI, https://github.com/mathisvickie/sign-expired also has the same problem. And I can reproduce this problem on Windows Server 24H2 (26100.3194). Still have no clue to the root cause...