Getting Code-Signing Certificate
Scope: Easy2Patch (All Versions)
Create Code-Signing Certificate Template
To create a Code Signing certificate template in Windows Server Certification Authority, follow these steps:
Open the Certification Authority snap-in on your Windows Server.
Right-click the Certificate Templates folder, and select Manage.
In the Certificate Templates console, right-click Code Signing, and select Duplicate Template.
In the Duplicate Template dialog box, select Windows Server 2003 Enterprise as the template type.
In the General tab of the Properties dialog box, enter a unique name for the new template, such as "Code Signing 2019".
In the Request Handling tab, select "Allow private key to be exported".
In the Subject Name tab, select "Supply in the request".
In the Extensions tab, select "Application Policies" and click Edit.
In the Application Policies Properties dialog box, select "Code Signing" and click OK.
In the Security tab, add the appropriate users or groups who will be able to enroll for this certificate template.
Click OK to save the template.
Right-click the Certificate Templates folder, select New, and select Certificate Template to Issue.
In the Enable Certificate Templates dialog box, select the new Code Signing certificate template that you just created.
Click OK to close the dialog box.
After completing these steps, the Code Signing certificate template will be available for users or groups to enroll and obtain a code signing certificate from your Certification Authority.
Request Code-Signing Certificate
To request a code signing certificate from a Windows Server Certification Authority (CA), you can follow the steps below:
Open the Certificates snap-in for the Microsoft Management Console (MMC). You can do this by pressing the Windows key + R on your keyboard, typing "certlm.msc" in the Run dialog box, and pressing Enter.
Click Personel then select Certificates in Local Machine certificate repository.
Right click Certificates folder,
Select All Tasks > Request New Certificate
In the Certificate Enrollment wizard, select "Active Directory enrollment policy".
Select "Code Signing" as the certificate template (as previously created template) and click Next.
Click More Information link,
In the Certificate Information window, provide the required information for the certificate, such as the Common Name and Organization.
Click the Details button to specify any additional information that you want to include in the certificate request, such as the Key Usage and Extended Key Usage.
Click Next to continue.
Submit the certificate request file to the Windows Server Certification Authority.
Note: The steps may vary slightly depending on the version of Windows Server you are using.
Installing Code Signing Certificate
General steps to import a code signing certificate to a local machine repository:
Open the Microsoft Management Console (MMC) by typing "mmc" in the Windows search bar and pressing Enter.
Click on "File" in the top left corner and select "Add/Remove Snap-in".
Select "Certificates" and click on "Add".
Choose "Computer account" and click on "Next".
Select "Local computer" and click on "Finish".
Click on "OK" to close the Add/Remove Snap-in window.
Expand the "Certificates (Local Computer)" folder and right-click on "Personal".
Select "All Tasks" and then "Import".
Follow the import wizard to browse and select the code signing certificate file and complete the import process.
After the import is completed, the code signing certificate should be available in the local machine repository under the "Personal" folder.
Note: The exact steps may vary depending on the operating system and version of the MMC being used. It is also important to ensure that the code signing certificate is valid and issued by a trusted Certificate Authority (CA).
The Code-Signing certificate to be used must be located under LocalComputer\My (Personnel). Therefore, it should not be continued without importing into this repository.
Last updated