search

ms-iot / security

71 stars 51 forks source link

Only P7 Embedded signatures are supported with Digest Signing #15

Closed blizzard4591 closed 7 years ago

blizzard4591 commented 7 years ago

I tried to use the CertGen/MakeSB.ps1 script to generate SecureBoot keys, but signing the Signature Lists is failing:

Done Adding Additional Store SignTool Error: Only P7 Embedded signatures are supported with Digest Signing. SignTool Error: An unexpected internal error has occurred. Error information: "Only Embedded P7 signatures are supported for Digest Signing" (-2147024809/0x80070057)

This happens on a Windows 10 x64 system with the Windows 10 SDK installed, i.e. signtool has version 10.0.14393.33. Is there a work-around?

IoTGirl commented 7 years ago

Hi Blizzard4591, Have you given this feedback through the Feedback tool?
Sincerely, IoTGirl

IoTGirl commented 7 years ago

Hi Stefan, Would you mind taking a look at this issue? Sincere thanks! IoTGirl

blizzard4591 commented 7 years ago

No, I have not used the Feedback-Tool (I guess you are referring to the Windows 10 Feedback-Tool?) - what would be the most appropriate place?

merzink commented 7 years ago

Hi Blizzard4591,

The issue with signtool was identified and has been fixed. The official SDK with the fix will release with the Windows 10 Creator's Update but the latest preview SDK should also have the fix (available via https://www.microsoft.com/en-us/software-download/windowsinsiderpreviewSDK). Alternatively, you can try using the Win8.1 SDK if that's easier.

Hope that helps.

Cheers, Merzin

IoTGirl commented 7 years ago

Hi Blizzard4591, Can you please confirm Merzin's response and reopen if you still see this issue? For the future, the Feedback tool creates issues that get routed directly to the feature owner within Microsoft so if your issue is with a Windows component rather than sample code, that is usually the best method to let Microsoft know about it. Sincerely, IoTGirl