CODEWITHSUNDEEP
macoscodesignsigntool
Shoji Urashita
Shoji Urashita

Reputation: 886

How to codesign with an Extended Validation Code Signing Certificate on Mac

I am trying to codesign with hardware token on Mac.

According to this

https://sectigo.com/knowledge-base/detail/Signing-with-an-Extended-Validation-Code-Signing-Certificate/kA03l000000c4TX

  1. Plug your Token into your computer.
  2. Open SafeNet Tools
  3. Open Command Prompt
  4. Input the following command below: signtool sign /tr http://timestamp.sectigo.com /td sha256 /fd sha256 /a "Path_to_the_file_you_wish_to_sign "
  5. SafeNet should open with a prompt asking users to input your password for the token.
  6. After successfully inputting the password, your application will be successfully signed. At this point, you’re all set to start distributing your application to your end-users! For those wishing to check that the application was successfully signed, please see the steps below.

It worked fine on my Windows.

Now, how do I codesign on Mac?

I am trying like this

$ codesign -s "Your Company, Inc." "/path/to/yourApp.app"

But it says "Warninig: unable to build chain to self-signed root for signer xxxx"

Upvotes: 1

Views: 832

Answers (3)

Csaba Virag
Csaba Virag

Reputation: 1

  1. Installing Sectigo intermediate certificates from the link Matthew provided (https://support.sectigo.com/articles/Knowledge/Sectigo-Intermediate-Certificates) solved the problem of "Warning: unable to build chain to self-signed root for signer ..."

    • Sectigo Public Code Signing CA EV R36 and
    • SectigoPublicCodeSigningRootR46_AAA)

  2. Then for the PIN challenge window (codesign is trying to sign data. Enter PIN to allow this) what I got when running

    codesign -s "name of the Safenet certificate" ./binary

    I followed this thread https://discussions.apple.com/thread/254527538?sortBy=best

    That describes how to set the PIN (token unlock password) policy to accept max 8 digits unlock PIN/password and then to change the current PIN/password to numeric, max 8 digits one. Actually, I did not have to change anything. After changing my PIN to eg. 12345678, codesign could sing the binary file.

  3. Run codesign -v ./binary to validate and no error was shown.

Upvotes: 0

Matthew Green
Matthew Green

Reputation: 101

To get past this problem, I installed the two EV Code Signing root certificates from here: https://support.sectigo.com/articles/Knowledge/Sectigo-Intermediate-Certificates

Unfortunately I then get prompted for a PIN and as yet I have no idea what the PIN is.

Upvotes: 1

Shoji Urashita
Shoji Urashita

Reputation: 886

apple developer forum thread

About an EV code signing certificate by sectigo.com,

It’s not that it’s not supported per se, just that it doesn’t buy you very much.

and it is recommended to obtain an apple-issued code signing certificate.

I am not sure what it really means, but it seems that I should obtain an apple-issued code signing certificate.

Upvotes: 0

Related Questions