"Code Signing" using a personal digital signature

I have recently accquired a Digital Signature for accessing official Danish sites and for signing and encrypting e-mail.

Today at work I helped a coworker with signing an ActiveX control, that made me consider if my personal digital signature could be used to sign code as well. When I came home I checked the advanced options of my digital signature, and Code Signing was among the certificate purposes:

Checking out the advanced options of my digital signature reveals that it can also be used for signing code. Yay!

Okay, that was really cool. So now onto the details of actually signing the code. 

First I downloaded the Microsoft Authenticode Tools and extracted them to C:\Program Files\CodeSign. To sign an executable I would just need to run signcode.exe. I would however, need the a .cer file containing the public key of my digital signature and a .pvk file containing my private key. The issuer had disabled export to .cer includining the private key, so I had to find a different solution. From the issuers page it was possible to export the key (both public and private) to .pkcs12.

Using the parts of the steps described on Matthew Jones' Page I got the .pkcs12 (which is the same as a .pfx file) converted to a .pem file and then finally to a .pvk file.

To perform these steps you need OpenSSL for Windows and the PVK utility.

To convert the .pfx file to .pem:

openssl pkcs12 -in sune.pkcs12 -nocerts -nodes -out sune.pem

To convert the .pem file to .pvk:

pvk -in sune.pem -topvk -out sune.pvk

Using the cert2spc.exe executable from the authenticode tools I turned my .cer file into a .spc file.

Now I had everything to sign my first file (using Wise for Windows Installer):

Typing in the details needed to digitally sign my installer package for my program Davina's GGS Timer.

or from the command line:

C:\Program Files\CodeSign>signcode.exe -spc sune.spc -v sune.pvk -n "Davina's GGS Timer" -i http://www.tanis.dk/Products/DavinasGGSTimer -t http://timestamp.verisign.com/scripts/timestamp.dll DavinasGGSTimerInst.exe

A quick compile and running chktrust.exe from the authenticode tools on my installer exe now gives me this result:

Verifying the digital signature on my signed installation program.

I'll be signing my productions from now on.