Windows Installer Editor Reference
262
Advanced Installations
Adding a Digital Signature to an Installation
Use the Digital Signature page to add an Authenticode digital signature to an installation
file so its integrity and authenticity can be verified.
Digital signature methods
The file signing tool that is used to digitally sign a file depends on the type of your digital
certificate:
z
Public/private key pair files
This method requires a credentials file (.SPC or .CER) and a private key file (.PVK).
This method is supported by the signcode.exe tool. For details, search for
“Signcode” in the MSDN Library (
msdn.microsoft.com/library/
).
z
Personal Information Exchange file
This method requires a Personal Information Exchange file (.PFX), which is a
container file for the public/private key information. This method is supported by the
signtool.exe tool. For details, search for “Signtool” in the MSDN Library
(
msdn.microsoft.com/library/
).
Requirements
z
You must have a valid code signing certificate, which you can obtain from a
commercial certificate authority such as Verisign. For a list of certificate authorities,
search for “Microsoft Root Certificate Program Members” in the MSDN Library
(
msdn.microsoft.com/library/
).
z
You must have the signtool.exe or signcode.exe tool on your computer.
z
Signtool.exe requires the CAPICOM 2.0 redistributable to be installed and registered
on your computer. CAPICOM provides services for digitally signing applications, and
is available from the Microsoft Web site.
z
The location of signtool.exe or signcode.exe must be specified on the Digital
Signature tab in Wise Options, or they must be available on the system path.
To add a digital signature
Select Installation Expert > Digital Signature page, mark Add a digital signature, and
complete the page:
z
Web URL
Enter your organization’s Web site address.
z
Descriptive Name
Enter the name of your application. This name is embedded in your Authenticode
certificate to let end users verify the name of the application they are installing.
z
TimeStamp URL
Specify the URL you use for your timestamping service. Timestamping lets end
users distinguish between a certificate that has expired but was valid when it was
used to sign the installation, and a certificate that was used to sign an installation
while it was expired. The timestamping service must be available on your computer
to build the installation but does not need to be available to the end user running
the installation.
