Sign Authenticode files with Visual Studio using KSP library

Visual Studio is an an Integrated Development Environment (IDE) for software development on the Windows platform. It provides a user-friendly interface for writing, compiling, testing, and debugging code. Visual Studio supports multiple programming languages, including C++, C#, Visual Basic, and more.

Follow these instructions to sign with Visual Studio and securely reference your private key stored in Software Trust Manager.

Tip

Strong name signing is not supported via Visual Studio, refer to Sign strong name assemblies with SignTool.

Prerequisites

Windows operating system
Visual Studio
Download and configure Software Trust Manager clients tools
Configure your credentials
Sync your certificate to the Windows certificate store

Certificate requirements

While Visual Studio allows all publicly trusted certificates, private trust certificates need to meet the following requirements:

Key usage
This parameter defines what the certificate may be used for. Set this parameter to Digital Signature for self-signing certificates.

Text extension

This parameter includes settings for the following extensions:

Table 1. Text extension constraints

Constraints	Description
Extended Key Usage (EKU)	This extension indicates additional purposes for which the certified public key may be used. For self-signing certificates, this parameter should include the extension string "2.5.29.37={text}1.3.6.1.5.5.7.3.3", which indicates that the certificate will be used for code signing.
Basic constraints	This extension indicates whether or not the certificate is a Certificate Authority (CA). For self-signing certificates, this parameter should include the extension string "2.5.29.19={text}", which indicates that the certificate is an end entity (not a CA).

Constraints

Description

Extended Key Usage (EKU)

This extension indicates additional purposes for which the certified public key may be used.

For self-signing certificates, this parameter should include the extension string "2.5.29.37={text}1.3.6.1.5.5.7.3.3", which indicates that the certificate will be used for code signing.

Basic constraints

This extension indicates whether or not the certificate is a Certificate Authority (CA).

For self-signing certificates, this parameter should include the extension string "2.5.29.19={text}", which indicates that the certificate is an end entity (not a CA).

Configure environment variables

Visual Studio will need to access you private key stored DigiCert® Software Trust Manager to enable signing. To make this possible you need to provide your DigiCert ONE host, API key, and client authentication certificate and password using one of the methods below:

Example 1. Persistent variables

Follow these steps to set persistent environment variables:

Search for environment variables in the Windows start menu.
Select Edit for either system or user account environment variables.
Select New.
Add the variable name and value for each of the DigiCert® Software Trust Manager environment variables.
Click on OK to close the dialog.

Example 2. Session-based environment variables

Follow these steps if you did not configure your environment variables in the previous step:

Download SMCTL.
Open Command Prompt.

To configure session-based environment variables, run:

set SM_API_KEY=<API key> 
set SM_HOST=<host URL>
set SM_CLIENT_CERT_FILE=<P12 client authentication certificate file path>
set SM_CLIENT_CERT_PASSWORD=<P12 client authentication certificate password>

Configure Visual Studio

The Visual studio configuration procedure depends on how you have configured your environment variables in the previous step:

Example 3. Persistent variables are set

Follow these steps if you configured your environment variables in the previous step:

Open Visual Studio.
Select Signing setup.
Select Choose Certificate.
Choose Select from store.
Select the appropriate certificate from the popup.
Note
Sync the necessary certificate to the Windows store, if the certificate you require is not available for selection.
Select the current certificate as the signing method.
Choose the algorithm and fill in the timestamp sever URL.

Example 4. Session-based variables set