return FALSE; $r = well_tag_thread__update(array('id' => $id), $update); return $r; } function well_tag_thread_find($tagid, $page, $pagesize) { $arr = well_tag_thread__find(array('tagid' => $tagid), array('id' => -1), $page, $pagesize); return $arr; } function well_tag_thread_find_by_tid($tid, $page, $pagesize) { $arr = well_tag_thread__find(array('tid' => $tid), array(), $page, $pagesize); return $arr; } ?>windows 10 - signtool with csp kc f introduces a very long delay on an offlineisolated CI server? - Stack Overflow

科技改变生活-雨落星辰 - 所有的伟大,都源于一个勇敢的开始

    最新消息：雨落星辰是一个专注网站SEO优化、网站SEO诊断、搜索引擎研究、网络营销推广、网站策划运营及站长类的自媒体原创博客
    你的位置： 首页>programmer>windows 10 - signtool with csp kc f introduces a very long delay on an offlineisolated CI server? - Stack Overflow

    windows 10 - signtool with csp kc f introduces a very long delay on an offlineisolated CI server? - Stack Overflow

    programmeradmin5浏览0评论

    I am trying to integrate Code Signing with a DigiCert SafeNet Token based cert with our CI machine.

    I am following the description given in which leads to my command line - that does work, but very slowly:

    Please note that I have specifically included windows-10 as tag on this question, as I am unsure whether this comes from signtool or is a Windows side effect, because when viewing a certificate ("Details") in Windows Explorer, I also get such a delay, because the machine is airgapped. (The timestamp server is explicitly allowed though.)

    D:\TEMP>signtool.exe sign /csp "eToken Base Cryptographic Provider" /k "[{{token_password}}]=priv_key_container_name" /f token_exported_cert.cer /tr  /td SHA256 /fd SHA256 /v /debug .\test.dll

The following certificates were considered:
    Issued to: My Company (redacted)
    Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    Expires:   Wed Apr 11 00:59:59 2xxx
    SHA1 hash: 633...

After EKU filter, 1 certs were left.
After expiry filter, 1 certs were left.
The following certificate was selected:
    Issued to: My Company (redacted)
    Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    Expires:   Wed Apr 11 00:59:59 2xxx
    SHA1 hash: 633...

<<<<<<<<<<<<<<<<<<<<<<<<<<< Delay of about 1m 20sec here <<<<<<<<<<<

The following additional certificates will be attached:
    Issued to: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    Issued by: DigiCert Trusted Root G4
    Expires:   Tue Apr 29 00:59:59 2036
    SHA1 hash: 7B0...

Done Adding Additional Store

<<<<<<<< *No* Password or delay here, thanks to "[{{token_password}}]=priv_key_container_name"

Successfully signed: .\test.dll

Number of files successfully Signed: 1
Number of warnings: 0
Number of errors: 0

    I can get this to run with no delay, but then I get a password prompt:

    D:\TEMP>signtool.exe sign /sha1 633...c /tr  /td SHA256 /fd SHA256 /v /debug .\test.dll

The following certificates were considered:
    Issued to: My Company (redacted)
    Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    Expires:   Wed Apr 11 00:59:59 2xxx
    SHA1 hash: 633...c

After EKU filter, 1 certs were left.
After expiry filter, 1 certs were left.
After Hash filter, 1 certs were left.
After Private Key filter, 1 certs were left.
The following certificate was selected:
    Issued to: My Company (redacted)
    Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    Expires:   Wed Apr 11 00:59:59 2xxx
    SHA1 hash: 633...c

Done Adding Additional Store

<<<<<<<<<<<<<<<<<<< Interactive Password Prompt here (Windows GUI of SafeNet Client)

Successfully signed: .\test.dll

Number of files successfully Signed: 1
Number of warnings: 0
Number of errors: 0

    One apparent difference being that in the "slow" case it tells me:

    The following additional certificates will be attached:
    Issued to: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1

    but I'm unsure what to make of that detail.

    I am trying to integrate Code Signing with a DigiCert SafeNet Token based cert with our CI machine.

    I am following the description given in https://stackoverflow/a/54439759/321013 which leads to my command line - that does work, but very slowly:

    Please note that I have specifically included windows-10 as tag on this question, as I am unsure whether this comes from signtool or is a Windows side effect, because when viewing a certificate ("Details") in Windows Explorer, I also get such a delay, because the machine is airgapped. (The timestamp server is explicitly allowed though.)

    D:\TEMP>signtool.exe sign /csp "eToken Base Cryptographic Provider" /k "[{{token_password}}]=priv_key_container_name" /f token_exported_cert.cer /tr http://timestamp.digicert /td SHA256 /fd SHA256 /v /debug .\test.dll

The following certificates were considered:
    Issued to: My Company (redacted)
    Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    Expires:   Wed Apr 11 00:59:59 2xxx
    SHA1 hash: 633...

After EKU filter, 1 certs were left.
After expiry filter, 1 certs were left.
The following certificate was selected:
    Issued to: My Company (redacted)
    Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    Expires:   Wed Apr 11 00:59:59 2xxx
    SHA1 hash: 633...

<<<<<<<<<<<<<<<<<<<<<<<<<<< Delay of about 1m 20sec here <<<<<<<<<<<

The following additional certificates will be attached:
    Issued to: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    Issued by: DigiCert Trusted Root G4
    Expires:   Tue Apr 29 00:59:59 2036
    SHA1 hash: 7B0...

Done Adding Additional Store

<<<<<<<< *No* Password or delay here, thanks to "[{{token_password}}]=priv_key_container_name"

Successfully signed: .\test.dll

Number of files successfully Signed: 1
Number of warnings: 0
Number of errors: 0

    I can get this to run with no delay, but then I get a password prompt:

    D:\TEMP>signtool.exe sign /sha1 633...c /tr http://timestamp.digicert /td SHA256 /fd SHA256 /v /debug .\test.dll

The following certificates were considered:
    Issued to: My Company (redacted)
    Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    Expires:   Wed Apr 11 00:59:59 2xxx
    SHA1 hash: 633...c

After EKU filter, 1 certs were left.
After expiry filter, 1 certs were left.
After Hash filter, 1 certs were left.
After Private Key filter, 1 certs were left.
The following certificate was selected:
    Issued to: My Company (redacted)
    Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    Expires:   Wed Apr 11 00:59:59 2xxx
    SHA1 hash: 633...c

Done Adding Additional Store

<<<<<<<<<<<<<<<<<<< Interactive Password Prompt here (Windows GUI of SafeNet Client)

Successfully signed: .\test.dll

Number of files successfully Signed: 1
Number of warnings: 0
Number of errors: 0

    One apparent difference being that in the "slow" case it tells me:

    The following additional certificates will be attached:
    Issued to: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1

    but I'm unsure what to make of that detail.

    • windows-10
    • code-signing
    • signtool
    • authenticode
    • digicert
    Share Improve this question asked Mar 20 at 8:48 Martin BaMartin Ba 39.1k35 gold badges197 silver badges362 bronze badges
    Add a comment  | 

    1 Answer 1

    Reset to default 1

    I would suggest tracing with Wireshark the network connections attempted during the signing process, there is probably one blocked by your network configuration that ultimately times out. For example signtool may attempt to check if the certificate was revoked, or to pull the intermediate issuer certificates by following the "Authority Information Access" URL in the signing certificate.

    You could try installing the intermediate certificates in the Windows truststore so signtool won't download it. If it doesn't work you could also try an alternative signing tool such as Jsign (disclaimer: I'm the author).

    继续浏览有关 的文章

    与本文相关的文章

    发布评论

    评论列表(0)

    1. 暂无评论