Code Signing with SignTool and AzureSignTool

signtool.exe is Microsoft's official signing tool, included in the Windows SDK. AzureSignTool is a free, open-source extension that adds Azure Key Vault support. Together they cover the most common Windows code signing workflows.

Both tools sign all standard Windows file types: .exe, .dll, .msi, .msix, .cab, .ps1, .appx and .sys. Choose signtool.exe for USB tokens and local certificate store, or AzureSignTool for cloud-based signing with Azure Key Vault.

What is AzureSignTool?

dotnet tool install --global AzureSignTool

AzureSignTool sign \
  -kvu https://your-vault.vault.azure.net \
  -kvc YourCertName \
  -kvt your-tenant-id \
  -kvi your-client-id \
  -kvs your-client-secret \
  -fd sha256 \
  -tr http://timestamp.digicert.com \
  -td sha256 \
  "MyApp.exe"

Common signtool commands

signtool sign /fd sha256 /tr http://timestamp.digicert.com /td sha256 /a "MyApp.exe"

signtool sign /fd sha256 /tr http://timestamp.digicert.com /td sha256 /sha1 ABCDEF1234567890 "MyApp.exe"

signtool verify /pa /v "MyApp.exe"

signtool sign /fd sha256 /tr http://timestamp.digicert.com /td sha256 /a *.exe

CI/CD pipeline examples

AzureSignTool integrates into Azure DevOps, GitHub Actions and GitLab CI. Here are examples for the most common pipelines:

Azure DevOps

- task: DotNetCoreCLI@2
  displayName: 'Install AzureSignTool'
  inputs:
    command: 'custom'
    custom: 'tool'
    arguments: 'install --global AzureSignTool'

- script: |
    AzureSignTool sign \
      -kvu $(KeyVaultUrl) \
      -kvc $(CertificateName) \
      -kvt $(TenantId) \
      -kvi $(ClientId) \
      -kvs $(ClientSecret) \
      -fd sha256 \
      -tr http://timestamp.digicert.com \
      -td sha256 \
      "$(Build.ArtifactStagingDirectory)\**\*.exe"
  displayName: 'Sign executables'

GitHub Actions

- name: Install AzureSignTool
  run: dotnet tool install --global AzureSignTool

- name: Sign executables
  run: |
    AzureSignTool sign \
      -kvu ${{ secrets.KEY_VAULT_URL }} \
      -kvc ${{ secrets.CERT_NAME }} \
      -kvt ${{ secrets.TENANT_ID }} \
      -kvi ${{ secrets.CLIENT_ID }} \
      -kvs ${{ secrets.CLIENT_SECRET }} \
      -fd sha256 \
      -tr http://timestamp.digicert.com \
      -td sha256 \
      "MyApp.exe"

Store Key Vault credentials as pipeline variables or secrets. Use Azure RBAC with a managed identity for keyless authentication.