title: Windows: How to sign exe using certificate issued by Certum?
body: <p>My goal is to sign an unsigned executable file on Windows using a certificate. From my general knowledge I know that I need a public and a private key pair for a digital signature. I have also installed the Windows SDK, which provides <code>signtool.exe</code> and <code>makecert.exe</code>. </p>
  
  <p>I have already obtained a certificate online, comprising a CER, a PEM, and a CRT file.</p>
  
  <p>My question now is how I have to use these tools and the certificate files in order to sign an executable. According to <a href="https://stackoverflow.com/questions/6307886/how-to-create-pfx-file-from-certificate-and-private-key">here</a>, the CRT file is the private key. From what I've learned so far, the CER and the PEM file are basically the same but with different encodings. What are the they for? Are they the public key? And how do I sign my executable?</p>
  
  <p>EDIT: I've tried installing the CRT file to a certificate store and then signing using that certificate:</p>
  
  <pre><code>"C:\Program Files (x86)\Windows Kits\8.1\bin\x64\signtool.exe" sign /debug /fd SHA256 /a /n "&lt;Issued_To&gt;" /t http://timestamp.comodoca.com/authenticode &lt;Filename&gt;
  </code></pre>
  
  <p>Here <code>&lt;Issued_To&gt;</code> was replaced with the data from the certificate and <code>&lt;Filename&gt;</code> is the name of the file I wanted to sign. The output I get from signtool is the following:</p>
  
  <pre><code>The following certificates were considered:
      ...
  
      Issued to: ...
      Issued by: Certum Code Signing CA SHA2
      Expires:   Thu Oct 12 14:37:04 2017
      SHA1 hash: BA081A67D3F2DDDC9268121DCBA04F43D6CD37FB
  
      ...
  
  After EKU filter, 1 certs were left.
  After expiry filter, 1 certs were left.
  After Subject Name filter, 1 certs were left.
  After Private Key filter, 0 certs were left.
  SignTool Error: No certificates were found that met all the given criteria.
  </code></pre>