Guides
How to sign Windows binaries in CI
Authenticode signing needs a certificate that must not be exposed.
5 min read
Authenticode signing needs a certificate that must not be exposed.
Why it happens
The private key has to be available to signtool without being recoverable from logs or artifacts.
How to fix it
- Use a cloud HSM or Azure Trusted Signing rather than a PFX in a secret
- If using a PFX, store it base64-encoded and delete it after signing
- Sign in a job scoped to a protected environment with required reviewers
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.
Related
How to make Windows CI fasterWindows jobs take three times as long as the equivalent Linux jobs.How to cache MSBuild outputEvery build recompiles all projects.Installing Visual Studio components in CIA required VS workload is missing and installing it takes fifteen minutes.How to parallelise .NET tests.NET tests run serially and take twenty minutes.