signcode [options] filename

-spc spcfile

The Software Publisher File (spc) that contains the X.509 certificate chain used to digitally sign the PE executable.

-v pvkfile

The Private Key File (pvk) that contains the private key used to digitally sign the PE executable. This private key must match the public key inside the publisher X.509 certificate.

-a md5 | sha1

The hash algorithm used in the digital signature of the PE executable. The default algorithm is MD5.

-$ individual | commercial

Add information about the publisher, i.e. if the signature is generated by an individual or a commercial entity.

-n description

Add a textual description of the signed file.

-i url

Add a URL associated to the publisher or the signed file.

-t url

URL to a timestamp service to countersign the PE executable. Countersignature is required if you want the PE executable signature to be valid after the publisher certificate expires. The countersignature proves that the publisher had a valid (non-expired) certificate when the PE executable was signed.

-tr #

Number of retries to get a timestamp for the countersignature.

-tw #

Delay (in seconds) between the retries to get a timestamp for the countersignature.

-k name

CryptoAPI key container name (when not using -v).

-p name

CryptoAPI provider name (when not using -v).

-y #

CryptoAPI provider type (when not using -v or -p).

-ky signature | exchange | #

CryptoAPI key type (when not using -v).

-r localMachine | currentUser

CryptoAPI key location (when not using -v).

-help, -h, -?, /?

Display help about this tool.