As of June 2023 code signing requires that hardware tokens must be used. The following documentation is an opinionated way to to make this work using digicert. This document does not cover initial setup and purchase of ev code signing cert. This document will only cover using an ev hardware token with SafeNet.
DigiCert’s SafeNet instructions.
The hardware token must be attached to the computer. The SafeNet Authentication client tool must be running in the user session and logged in.
WILL NOT WORK IN RDP/SSH SESSION.
Example command syntax as of March 25, 2023.
.\signtool.exe sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /n "Certs Subject Name Goes Here" "C:\path\to\fileToSign.exe"
The above example will prompt you with for the hardwares signing token and it must be manually entered for each file signed.
How to Enable Single Logon for a SafeNet Token
Navigate to Start > Program Files > Safenet > Safenet Authentication Client Tools.
With the above done SafeNet will only prompt once per session for the hardware signing token password.
Export the certificate. See Automate Extended Validation (EV) code signing. The examples below is taken from that stackoverflow post. It has screenshots. Read it.
Ensure that the ** characters remain just replace the characters **THE_PASSWORD.
& "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\signtool.exe" sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /n "Certs Subject Name Goes Here" /f "C:\the\path\to\exported\cert.cer" /csp "eToken Base Cryptographic Provider" /kc "[THE_READER{{THE_TOKEN_PASSWORD}}]=THE_CONTAINER_NAME" "C:\path\to\fileToSign.exe"
For /kc the value should be in the format below:
[reader{{password}}]=name
Where: