Configuring Manifests on Windows 8.1 and Windows 10

By using PowerShell

By using signing utilities (deprecated)

1. Use the New-SelfSignedCertificate cmdlet to create a new self-signed certificate. For example:

   PowerShell

   PowerShell

   New-SelfSignedCertificate -DnsName "www.mycompany.com" -Type codesigningcert -Subject "CN=Test" -CertStoreLocation "cert:\LocalMachine\My"

   Where:

   DnsName - is the DNS name (or names) to use as the alternative name for the certificate subject.

   Type - is the type of the new certificate. To sign a COM client, use the CodeSigningCert value.

   Subject - is the subject of the new certificate.

   CertStoreLocation - is the certificate store to which the new certificate will be added. It can be the local machine certificate store or the current user certificate store. To learn more about the certificate stores, see the following article at the Microsoft website:

   docs.microsoft.com/en-us/windows-hardware/drivers/install/certificate-stores

2. If needed, export the created certificate data to a .pfx file. To do this, use the Export-PfxCertificate cmdlet. For example:

   PowerShell

   PowerShell

   $pwd = ConvertTo-SecureString -String 'mypassw0rd' -Force -AsPlainText
   $cert = Get-ChildItem -Path Cert:\LocalMachine\My -CodeSigningCert
   Export-PfxCertificate -Cert 'cert:\LocalMachine\my\' + $cert.thumbprint -FilePath 'c:\temp\cert.pfx' -Password $pwd

   Where:

   Cert - is the path to the created certificate, in the certificate store.

   FilePath - is the target .pfx file to which the certificate data will be exported.

   If the specified file already exists, it will be overwritten.

   Password - is the secure string that specifies the password of the created .pfx file. To get the password in the secure string format, use the ConvertTo-SecureString cmdlet.

3. Use the Set-AuthenticodeSignature cmdlet to sign your COM client with the certificate data. For example:

   PowerShell

   PowerShell

   $pfx = Get-PfxCertificate -FilePath 'C:\Temp\cert.pfx'
   Set-AuthenticodeSignature -FilePath "C:\Temp\Client1.exe" -Certificate $pfx

   – or –

   PowerShell

   PowerShell

   $cert = Get-ChildItem -Path Cert:\LocalMachine\My -CodeSigningCert
   Set-AuthenticodeSignature -FilePath "C:\Temp\Client1.exe" -Certificate $cert

   Where:

   FilePath - is the name of your COM client executable.

   Certificate - is the certificate data stored in a .pfx file or in the certificate store. To get the certificate data from a .pfx file, use the Get-PfxCertificate cmdlet. To get the certificate data form the certificate store, use the Get-ChildItem cmdlet.

The sample PowerShell script below shows how to sign a COM client:

You can get the signing utilities with Visual Studio or Windows SDK.

The MakeCert utility used to create certificates is deprecated. We recommend that you use the PowerShell approach described above to sign your COM client.

1. Use the MakeCert utility to create a self-signed certificate and a private key:

   MakeCert -r -n CertificateName -ss CertificateStore -sr localmachine -sv PrivateKeyFile.pvk OutputCertificateFile.cer

   Where:

   CertificateName - is the name of your certificate, it must comply with the X.500 standard and match the Publisher value in your client application’s manifest. For example, "CN=MyCompany";

   CertificateStore - is the name of your certificate store that will store the generated certificate;

   PrivateKeyFile.pvk - is the name of the file to which the utility will store the private key;

   OutputCertificateFile.cer - is the name of the file, to which the utility will store the certificate.

   The utility will prompt you for a password for the private key. Specify the password, if needed.

   The utility will generate a self-signed certificate and save it to the specified certificate store. It will also export the private key and the certificate information to the specified .pvk and .cer files.

2. Add the generated certificate to the Trusted Root Certification Authorities store for a local computer. To do this, you can use the CertMgr utility:

   CertMgr /add OutputCertificateFire.cer /s /r localmachine root

3. Use the Pvk2Pfx utility to copy the private key and the certificate information to a Personal Information Exchange file (.pfx):

   Pvk2Pfx /pvk PrivateKeyFile.pvk /spc OutputCertificateFile.cer /pfx OutoutCertificate.pfx

   The utility will generate the .pfx file with the specified name.

4. Use the SignTool utility to sign your COM client:

   SignTool sign /f OutoutCertificate.pfx MyCOMClient.exe

To verify that your client application is signed properly, you can use the verify command of the SignTool:

To learn more about code signing, see the Using SignTool to Sign a File article in the MSDN Library.