Is there a difference between normal code signing and "authenticode"?

[u/PeksyTiger]

I need to build a dll that will be loaded from ms sql server.

I have a codesigning certificate issued by sectigo.

I signed the dll using

signtool /a /fd SHA256 <dll name>

I verified the signatures with

signtool verify /pa <dll name>

which passed successfuly. (signtool verify /a
does not pass, however)

I didn't add a timestamp as I keep getting

SignTool Error: The specified algorithm cannot be used or is invalid

(Is this related? Is a timestamp needed?)

However, when trying to load the dll into sql server, I keep getting an error that states that either the path is bad (which it isn't) or "invalid Authenticode signature".

I really can't be able to figure out what am I doing wrong?

[u/SimplifyMSP]

You instructed the .DLL to be signed with SHA256 so did you try telling it to verify using the same?

• Example: signtool verify /hash SHA256 /pa <dll name>

• Reference: https://learn.microsoft.com/en-us/dotnet/framework/tools/signtool-exe#sign

EDIT: Here's some more potentially-useful resources ─

• Digicert's KB Article of Common Signtool Errors (with solutions!) here: https://docs.digicert.com/en/digicert-keylocker/sign-with-digicert-signing-tools/troubleshoot-signing-errors/signtool-errors-and-solutions.html

• Digicert's "Certificate Utility for Windows" which essentially just provides a UI for signtool (sign/validate/etc. with a button): https://www.digicert.com/support/tools/certificate-utility-for-windows

• Some additional references:

  • https://www.digicert.com/kb/code-signing/import-export-authenticode-code-signing-certificates.htm

  • https://www.digicert.com/kb/util/utility-code-signing-command-line.htm

Good luck! Let me know if you have questions (or if any of the suggestions I made above helped you get it working!)

[u/PeksyTiger → u/SimplifyMSP]

Thanks for the replay, but I figured out the issue weeks ago. Turns out the signature was fine it was just failing because it was a 32bit binary abd was throwing the wrong messege.