How to create a self-signed certificate and sign a .exe file

Here's an example how to create a new certificate, how to sign a file with the private key and finally, I show how to verify the signed file and why this fails.

First we start out by creating the certificate. This is done with the makecert.exe command-line tool. The following command creates a certificate named "RogTestCert" and adds it to certificate store called "RogCertStore". The -r option tells makecert to create a self-signed certificate. -pe marks the generated private key as exportable, which allows the private key to be included in the certificate.

>makecert.exe -r -pe -ss RogCertStore -n "CN=RogTestCert" RogTestCert.cer
Succeeded

You can now view the new certificate using the Certificate Manager.

To sign a file we use signtool.exe. We specify that we want to use the certificate named "RogTestCert" in the "RogCertStore" certificate store:

>signtool.exe sign /s RogCertStore /n RogTestCert myfile.exe
Successfully signed: myfile.exe

The file is now signed. If you right-click the file and choose Properties, you will notice that a new tab called "Digital signatures" has appeared.

Finally, we try to verify the myfile.exe's signature, which should result in an error, since RogTestCert is not a trusted root certificate:

>signtool.exe" verify myfile.exe
SignTool Error: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
SignTool Error: File not valid: myfile.exe

Number of errors: 1

How to view all trusted root certificates on a Windows machine

It's easy, just launch the Certificate Manager. Click Start -> Run -> certmgr.msc. The Certificate Manager should be available on Windows 2000, 2003, 2008, XP and Vista. In the Certificate Manager you can browse all trusted and revoked certificates, import and export certificates, examine certificate paths, etc.