Organize Cert for signing the application

[SailReal]

Hmm actually I'm not able to sign an executable using the key from the HTWG. I always get the following output:

signtool sign /debug /f sharkey_sign.p12 /p <pw> CageManager.exe

The following certificates were considered:
    Issued to: DFN-Verein Global Issuing CA
    Issued by: DFN-Verein Certification Authority 2
    Expires:   Sun Feb 23 01:59:59 2031
    SHA1 hash: C9DCB047AC8C5F0905ED77528CBD4B84D9463C45

    Issued to: DFN-Verein Certification Authority 2
    Issued by: T-TeleSec GlobalRoot Class 2
    Expires:   Sun Feb 23 01:59:59 2031
    SHA1 hash: E224BEF6D786220D262BB807AB6DACF9D3A89A93

    Issued to: T-TeleSec GlobalRoot Class 2
    Issued by: T-TeleSec GlobalRoot Class 2
    Expires:   Sun Oct 02 01:59:59 2033
    SHA1 hash: 590D2D7D884F402E617EA562321765CF17D894E9

    Issued to: Julian Raufelder
    Issued by: DFN-Verein Global Issuing CA
    Expires:   Sun May 16 14:29:19 2021
    SHA1 hash: 5AB2F3D8CDDFE18D6F139729F8C7DCF7387AD365

After EKU filter, 3 certs were left.
After expiry filter, 3 certs were left.
After Private Key filter, 0 certs were left.
SignTool Error: No certificates were found that met all the given criteria.

I double checked, that the private key is included in the certificate file (e.g. I'm able do encrypt and decrypt data using this key). Further it seems like the signtool uses this error message for a lot of different problems. If I create an certificate without interaction of an CA, I'm able to sign the application (signed with an not trusted certificate). The comparison of the certificates let me gamble, that the purpose must me set to something like "signing application":

...just to inform you about the current progress...

[SailReal]

Yes, there are indeed some purposes for code signing:

Will talk again to the computing center to find out if they can modify the list of purposes to add code signing to our signed certificate...

[SailReal]

@langweg The cheapest version I found is from digicert for $111.00 USD and can be ordered here: https://www.digicert.com/order/order-1.php Just follow the purchase process but make sure to buy a "Code Signing Certificate" (the cheaper version without EV) and as platform "Microsoft Authenticode".

Furthermore we can by an Yubikey e.g. 4 for $56.25 incl. shipping, which supports the PIV-Mode.

This tutorial demonstrates, how to store the certificate and how to sign an application using the signtool with a yubikey: https://pete.akeo.ie/2017/05/using-yubikey-to-store-code-signing.html If the order is arrived, you could let me know so I can take these steps.

[langweg]

Ordered a code signing certificate from DigiCert today. Initiated the process to order a YubiKey 4 to store the keys.