Signtool error: no certificates were found that met all the given criteria.

Question

Problem :

I want to sign the Windows 8 appx package with my pfx file which already I have. I am trying to use the command like below:

signtool.exe sign /fd sha256 /f "key.pfx" "app.appx"

But from this, I get below error:

“SignTool Error: No certificates were found that met all the given criteria.”

What "criteria" am I not meeting here? This is only for the testing purpose so these are self-signed certificates. I have already tried importing a key and then signing with it, but it always results in the above error. How can I fix above error?

Answer 1

When you are getting this error through a Visual Studio it is because there is a signing certificate setup should match your computer it is originally developed on.

So you can check this by going to your project properties > signing tab and checking your certificate details.

You can uncheck the "Sign the ClickOnce manifests" to disable the signing.

If you just don't want to turn this option off then you will have to install a certificate.

OR

Please always check the certificate expiry date first as most of your certificates have the expiry date. In my case my certificate has expired and I was trying to build my project.

Answer 2

At the time obtaining this error v9ia Visual Studio it was since there was a signing certificate setup to match the computer it was basically developed on. You can inspect this by going to the project properties > signing tab and checking the certificate details.

Attempt with /debug.1,2 As in :

signtool sign /debug /f mypfxfile.pfx /p <password> (mydllexectuable).exe

It will help you trace out what is going on. You must obtain output like this:

The following certificates were considered:
    Issued to: <issuer>
    Issued by: <certificate authority> Class 2 Primary Intermediate Server CA
    Expires:   Sun Mar 01 14:18:23 2015
    SHA1 hash: DD0000000000000000000000000000000000D93E

    Issued to: <certificate authority> Certification Authority
    Issued by: <certificate authority> Certification Authority
    Expires:   Wed Sep 17 12:46:36 2036
    SHA1 hash: 3E0000000000000000000000000000000000000F

After EKU filter, 2 certs were left.
After expiry filter, 2 certs were left.
After Private Key filter, 0 certs were left.
SignTool Error: No certificates were found that met all the given criteria.

You can view what filter is causing your certificate to not perform, or in case no certificates were considered.

In case you do not have to sign the app, right click on your project

Project Properties -> Signing -> uncheck "Sign the ClickOnce Manifest"

To resolve this problem, confirm the certificate is installed rightly

1.  Open Internet Explorer

2.  Click Tools > Internet Options > Content tab > Certificates

3.  Under the Personal tab, double-click the certificate

4.  At the bottom of the General tab, the following assertion should subsist: You have a private key that fulfill to this certificate.