Cannot sign windows app since 20.33.0

[wali-s]

• Version:
  electron-builder@20.33.0->20.34.0
  electron-updater@3.2.1->3.2.3

• Target:
  Windows x86 and x64

Builds worked fine on previous versions. WIN_CSC_LINK and CSC_KEY_PASSWORD are set. Signing on mac works fine.

The error I get while signing:

Cannot extract publisher name from code signing certificate: pkcs12: error reading P12 data: asn1: syntax error: indefinite length found (not DER)

It seems that it has something to do with the recent rewrite: "Another part of electron-builder was rewritten in Go — as result, to get publisher name from code signing certificate, openssl is not required anymore on macOS/Linux"

Thank you!

[develar]

Is it possible to send your p12 container and password (slack direct message or email)? Or, if it is not possible, maybe you can explain how did you create p12 file?

[develar]

Reproduced.

[develar]

@wali-s I need to know how did you produce such p12 file.

[ghk]

Hello I still have this issue with 2.4.3 app-builder-bin. Do you want me to email the p12 file?

[develar]

@ghk if you can provide p12 file and password (and explain how did you create this file), it will help to fix this issue.

[ghk]

I got it by buying from digicerts. Okay, Ill send you an email

[ert78gb]

Hi,

I don't like to comment on closed Issue, but it was closed only 5 days ago.

I have the same error. openssl pkcs12 -info -in filename.p12 result

...
Bag Attributes
    friendlyName: Ultimate Gadget Laboratories Kft.s DigiCert Inc ID
...
Certificate bag
Bag Attributes
    friendlyName: Ultimate Gadget Laboratories Kft.s DigiCert Inc ID
...
subject=/C=HU/L=Budapest/O=Ultimate Gadget Laboratories Kft./CN=Ultimate Gadget Laboratories Kft.
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Assured ID Code Signing CA

• electron-builder: 20.34.0

Any Idea?

[develar]

Fixed in 20.36.1.

@ert78gb Please try 20.36.1 And I didn't fully understand your issue :)

[ert78gb]

@develar
Sry for the not well-described error.

I had the Cannot extract publisher name from code signing certificate: pkcs12: error reading P12 data: asn1: syntax error: indefinite length found (not DER) error.
Now I try to use set publisherName in the build setup. Now I am waiting for the CI to finish the job.

I can not update the electron builder to 20.36.1. because requires Electron 3. in the changelog of 20.35.0 and one dependency of our app is not compatible with the electron 3 yet

You always answer very fast, when do you sleep? :)

[develar]

I can not update the electron builder to 20.36.1. because requires Electron 3. in the changelog of 20.35.0 and one dependency of our app is not compatible with the electron 3 yet

Only electron-updater requires electron 3. electron-builder supports even electron 1.x :) You can use latest electron-builder. Update: hmm... indeed, latest electron-builder requires electron-updater 4.0.0 .... and it means that if you use electron-updater, you must use electron 3...

[DalderupMaurice]

Same issue here - could this be fixed in a version still supporting Electron 2? @develar
I also have the same issue with electron-builder version=20.33.0
We cannot upgrade to Electron 3 because of this issue, which is not going to be resolved

[DalderupMaurice]

I've update electron-builder in the meanwhile, but I'm still having the issue with electron-builder 22.2.0.
Any news on this?

[ryanbadger]

Also having this issue on 22.2.0, tried upgrading to 22.3.2, same problem persists:
• cannot decode PKCS 12 data using Go pure implementation, openssl will be used error=pkcs12: error reading P12 data: asn1: syntax error: indefinite length found (not DER)

[ryanbadger]

OK I managed to get this to work, my scenario was my cert had expired and I bought a new one, for some reason this caused issues?

It seems to be fixed by setting publisherName in package.json under the win property:

"win": { "publisherName": "Click Here Digital Ltd", "target": [ { "target": "nsis", "arch": [ "x64", "ia32" ] } ] },

The publisherName MUST match the common name set in your code signing cert i believe. it seems this is required actually and should have been there before. @DalderupMaurice do you want to try adding this if you haven't already got it and see if it helps?