Windows - Code signing

[larryteal]

I'm trying to sign the app, but it doesn't work, can you share your success story?

I don't have an official certificate, I followed Microsoft's instructions to create a test certificate, I'm not sure if it's the right thing to do. ( Creating Test Certificates) I don't know that "publisherName" should correspond to that part of the tauri project. I have tried the project name and "identifier" in tauri.conf.json, and it seems that "identifier" is closer.

I successfully got the certificate.pfx file after I followed Microsoft's guide.

Specifically, I executed the following commands

1,MakeCert /n "CN=com.test.dev" /r /h 0 /eku "1.3.6.1.5.5.7.3.3,1.3.6.1.4.1.311.10.3.13" /e 12/31/2039 /sv certificate.pvk certificate.cer

2,Pvk2Pfx /pvk certificate.pvk /pi 123456 /spc certificate.cer /pfx certificate.pfx /po 123456

The "identifier" in tauri.conf.json is "com.test.dev" ,so "publisherName" is ”CN=com.test.dev“(right?) and all the places where the password is encountered are 123456

Next, I refer to Tauri's Windows Code Signing guidance document.

A. Convert your .cer to .pfx. I skipped it since I already have a certificate.pfx file.

B. Import your .pfx file into the keystore. Failed, but I tweaked it and it worked, but not sure if that's the right way to do it
The command succeeded $WINDOWS_PFX_PASSWORD = '123456'.
But another command Import-PfxCertificate -FilePath certificate.pfx -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_PFX_PASSWORD -Force -AsPlainText) failed.

+ ConvertTo-SecureString -String $env:WINDOWS_PFX_PASSWORD -Force -AsPl ...
+                                ~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : InvalidData: (:) [ConvertTo-SecureString]，ParameterBindingValidationException
+ FullyQualifiedErrorId : ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.ConvertToSecureStringCommand

I modified it and it worked Import-PfxCertificate -FilePath certificate.pfx -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String 123456 -Force -AsPlainText)

C. Prepare Variables.
The command openssl pkcs12 -info -in certificate.pfx succeeded and I got the localKeyID 01000000.

Prepare tauri.conf.json file
According to the documentation, tauri -> bundle -> windows in tauri.conf.json is changed to

"windows": {
        "certificateThumbprint": "01000000",
        "digestAlgorithm": "sha256",
        "timestampUrl": "http://timestamp.comodoca.com"
}

Save run npm run tauri build not yarn | yarn build.

Then got a signature error Error failed to bundle project: failed to run C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\signtool.exe

Which step is wrong? please help me
Thanks

[FabianLars]

Try the last step with the verbose flag again, it should hopefully get better output.

yarn tauri build --verbose / npm run tauri build -- --verbose (note the extra -- for npm to forward it to tauri)

I don't know that "publisherName" should correspond to that part of the tauri project.

A bit hard to say for me too, but for what it's worth we set publisher from tauri.conf.json as the Manufactor in the wix template (not sure if that's the same tbh). If publisher is not set it will fall back to the middle part of the bundler identifier.

[larryteal]

Thank you @FabianLars . I found the problem and succeeded.

Learned in Microsoft's documentation “publisherName” is "CN=Publisher", I didn't configure the wix template and my bundler identifier is "com.test.dev", So my “publisherName” is "CN=com.test.dev" "CN=test" . MakeCert /n "CN=com.test.dev" /r /h 0 /eku "1.3.6.1.5.5.7.3.3,1.3.6.1.4.1.311.10.3.13" /e 12/31/2039 /sv certificate.pvk certificate.cer
MakeCert /n "CN=test" /r /h 0 /eku "1.3.6.1.5.5.7.3.3,1.3.6.1.4.1.311.10.3.13" /e 12/31/2039 /sv certificate.pvk certificate.cer

After executing this command npm run tauri build -- --verbose, I identified the problem. (certificateThumbprint incorrect)

 Running [tauri_bundler::bundle::common] Command `C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\signtool.exe  sign /fd sha256 /sha1 01000000 /d test-sign 
/t http://timestamp.comodoca.com E:\demo\rust\code-sign\test-sign\src-tauri\target\release\test-sign.exe`
SignTool Error: Invalid SHA1 hash format: 01000000
       Error [tauri_cli_node] failed to bundle project: `failed to run C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\signtool.exe`

This command openssl pkcs12 -info -in certificate.pfx does not always get the correct certificateThumbprint .

Enter Import Password:
MAC: sha1, Iteration 2000
MAC length: 20, salt length: 20
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2000
Bag Attributes
    localKeyID: 01 00 00 00
    Microsoft CSP Name: Microsoft Strong Cryptographic Provider  
    friendlyName: PvkTmp:cee05b5b-38b7-4497-ae64-27c8c184a7df    
Key Attributes
    X509v3 Key Usage: 80
Enter PEM pass phrase:

This is how I got the correct certificateThumbprint information.

1. Execute the certmgr.msc command in Terminal to open Personal Certificate Management.
2. Find the certificate we imported earlier (We executed this command earlier Import-PfxCertificate -FilePath certificate.pfx -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String 123456 -Force -AsPlainText))
3. Double-click to open to view certificate details, where you have the correct certificate thumbprint.

That's all, I succeeded.

[RandomEngy]

Thanks @larryteal , I submitted a PR to update the docs to use your method: tauri-apps/tauri-docs#1327

The openssl command also failed for me, but certmgr.msc worked.

[hadastoroP]

https://tauri.app/v1/guides/distribution/sign-windows/
Describes well the way to sign with a pfx certificate.

2 Things to add there from my experience
a. You must add "publisher" to tauri.conf.json: under tauri->bundle (I just put something there...) otherwise the signing fails
b. To get the localKeyID is says to use:
openssl pkcs12 -info -in certificate.pfx
It works only with openssl version 1.1.1
you can get it here: https://slproweb.com/products/Win32OpenSSL.html (the light version is enough)