I found a nice how-to about signing here.
How to create and use code signing certificate on Vista computer (for testing purposes)
- Create self-signed root certificate (MyRootCA), use “MYPASSWORD1” as a password (you will type it 3 times).
makecert -n "CN=MyName Software Root Certificate Authority" -r -a sha1
-sv MyRootCA.pvk MyRootCA.cer -sr LocalMachine -ss MyName -sky signature
- Create child certificate (MyCodeSigningCA) for code signing, create “MYPASSWORD2” as password for new certificate and when you are asked for Issuer Signature, type “MYPASSWORD1”.
makecert -sv MyCodeSigningCA.pvk -iv MyRootCA.pvk -n "CN=MyName Software Code Signing CA"
-ic MyRootCA.cer MyCodeSigningCA.cer
- Create PFX key (use the password “MYPASSWORD2”).
pvk2pfx.exe -pvk MyCodeSigningCA.pvk -spc MyCodeSigningCA.cer -pfx MyCodeSigningCA.pfx
-po MYPASSWORD2
- Optional step.
cert2spc.exe MyCodeSigningCA.cer MyCodeSigningCA.spc
- Use your PFX key to sign Test1.exe program.
signtool sign /f MyCodeSigningCA.pfx /p MYPASSWORD2 /v /t
http://timestamp.verisign.com/scripts/timestamp.dll Test1.exe
- Install MyRootCA.cer root certificate on Vista computer to LOCAL MACHINE store using Certificates MMC snap-in:
- Run MMC.EXE on Vista computer (Start, Start Search, type mmc.exe, press Enter). MMC console window appears.
- Choose “File”, “Add/Remove Snap-in” menu command, the list of snap-ins appears, choose Certificates, choose Add command. The “Certificates snap-in” dialog appears, choose [x]”Computer account” radio button. “Select computer” dialog appears, choose “Local computer”.
- The “Certificates (Local computer)” snap-in node appears in MMC left window. Select “Certificates (Local computer)”-“Trusted Root Certification Authorities” – “Certificates” node. Choose “All Tasks” – “Import…” context menu command on “Certificates” node.
- Import your MyRootCA.cer certificate. “MyName Software Root Certificate Authority” will appear in the Trusted Root Certification Authorities certificates list, in “Issued To” and “Issued By” columns.
- Close MMC.
Run Test1.exe. Vista should detect the publisher of this EXE file as “MyName Software Code Signing CA”.