How to debug 403 Forbidden using SignTool w/ Trusted Signing?

Question

How to debug 403 Forbidden using SignTool w/ Trusted Signing?

Matt Haggard 40

I'm trying to sign an executable with Trusted Signing. I've got a verified certificate, but am getting a 403 forbidden error when trying to run it. Here's the full command (from bash):

/c/Program\ Files\ \(x86\)/Windows\ Kits/10/bin/10.0.22621.0/x64/signtool.exe sign -v -debug -fd SHA256 -tr http://timestamp.acs.microsof
t.com -td SHA256 -dlib /c/Users/matt/.nuget/packages/microsoft.trusted.signing.client/1.0.95/bin/x64/Azure.CodeSigning.Dlib.dll -dmdf azure
.signing.metadata.json dist/win-unpacked/my.exe

I've based authentication on https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential?view=azure-dotnet

I have also set the following environment variables with values from Azure portal:

export AZURE_CLIENT_ID='...'
export AZURE_TENANT_ID='...'
export AZURE_CLIENT_SECRET='...'

Here's the full output:

$ /c/Program\ Files\ \(x86\)/Windows\ Kits/10/bin/10.0.22621.0/x64/signtool.exe sign -v -debug -fd SHA256 -tr http://timestamp.acs.microsof
t.com -td SHA256 -dlib /c/Users/matt/.nuget/packages/microsoft.trusted.signing.client/1.0.95/bin/x64/Azure.CodeSigning.Dlib.dll -dmdf azure
.signing.metadata.json dist/win-unpacked/my.exe

Trusted Signing

Version: 1.0.95

"Metadata": {
  "Endpoint": "https://eus.codesigning.azure.net",
  "CodeSigningAccountName": "MYACCOUTNAME",
  "CertificateProfileName": "MYCERTPROFILENAME",
  "ExcludeCredentials": [
    "ManagedIdentityCredential",
    "WorkloadIdentityCredential",
    "SharedTokenCacheCredential",
    "VisualStudioCredential",
    "VisualStudioCodeCredential",
    "AzureCliCredential",
    "AzurePowerShellCredential",
    "AzureDeveloperCliCredential",
    "InteractiveBrowserCredential"
  ]
}

Submitting digest for signing...
Unhandled managed exception
Azure.RequestFailedException: Service request failed.
Status: 403 (Forbidden)

Headers:
Date: Mon, 04 Aug 2025 16:36:14 GMT
Connection: keep-alive
Strict-Transport-Security: REDACTED
x-azure-ref: REDACTED
X-Cache: REDACTED
Content-Length: 0

   at Azure.CodeSigning.CertificateProfileRestClient.SignAsync(String codeSigningAccountName, String certificateProfileName, SignRequest bo
dy, String xCorrelationId, String clientVersion, CancellationToken cancellationToken)
   at Azure.CodeSigning.CertificateProfileClient.StartSignAsync(String codeSigningAccountName, String certificateProfileName, SignRequest b
ody, String xCorrelationId, String clientVersion, CancellationToken cancellationToken)
   at Azure.CodeSigning.Dlib.Core.DigestSigner.SignAsync(UInt32 algorithm, Byte[] digest, SafeFileHandle safeFileHandle, CancellationToken 
cancellationToken)
   at Azure.CodeSigning.Dlib.Core.DigestSigner.Sign(UInt32 algorithm, Byte[] digest, SafeFileHandle safeFileHandle)
   at AuthenticodeDigestSignExWithFileHandleManaged(_CRYPTOAPI_BLOB* pMetadataBlob, UInt32 digestAlgId, Byte* pbToBeSignedDigest, UInt32 cb
ToBeSignedDigest, Void* hFile, _CRYPTOAPI_BLOB* pSignedDigest, _CERT_CONTEXT** ppSignerCert, Void* hCertChainStore)

SignTool Error: An unexpected internal error has occurred.
Error information: "Error: SignerSign() failed." (-2147467259/0x80004005)

How do I debug why I'm getting a 403 Forbidden error?

Swaroop Kolli 5,285 Reputation points Microsoft External Staff Moderator

2025-08-04T18:05:51.15+00:00

Hello @Matt Haggard,

Please check the trusted signing account name matches the one from the output metadata-

Please let us know if this is matching with the one in the metadata. If it is not matching, please change the field and let us know the behavior. Also please check if Trusted Signing role (Trusted Signing Certificate Profile Signer and Trusted Signing Identity Verifier) is assigned to the identity.

If there is an app registration associated with this, please make sure you navigate to app registration and grant admin consent for all API permissions.
Matt Haggard 40 Reputation points

2025-08-04T19:25:56.01+00:00

The name in CodeSigningAccountName in the metadata file matches the Name in Trusted Signing Accounts. They are both "com-onepartrain"

As best I can tell, I have the right roles. I go to Trusted Signing > [my account] > Access control (IAM) > Role assignments and I see my username with the roles Owner, Trusted Signing Certificate Profile Signer and Trusted Signing Identity Verifier.

As far as I can tell I have admin consent granted (though I can click the "Grant admin consent..." button again.

I'm not sure how the App registration I have knows how to be associated with my user, though. I don't see anything anywhere that indicates that the app registration belongs to my user or has the same permissions as my user.
Matt Haggard 40 Reputation points

2025-08-05T15:55:01.17+00:00

Swaroop, thank you! That appears to have been the issue. I would never have guessed that I could add the Role to the App Registration. If you have the power to change the UI, please list app registrations in the default list of things as shown here:
Swaroop Kolli 5,285 Reputation points Microsoft External Staff Moderator

2025-08-05T16:06:33.62+00:00

Hello @Matt Haggard,

That is a great news that the issue is resolved. I had posted my answer and if this answered your queries, please click "Accept Answer" and kindly upvote it.

Answer accepted by question author

Swaroop Kolli 5,285 Microsoft External Staff Moderator

Hello @Matt Haggard,

Please add the roles Trusted Signing Certificate Profile Signer and Trusted Signing Identity Verifier to the App Registration Object and let us know the behavior.

You can do this by navigating to the Trusted Signing account > add role assignment and add the two roles to the service principal by searching with the app registration name. I do not have enough privilege to change the UI but will definitely pass this information to the concerned team.

We’re always looking to improve and would love to hear your thoughts. If you have any ideas or feedback on the feature in the question, please let us know your idea in the below given portal and our development team would be constantly monitoring them. https://feedbackportal.microsoft.com/feedback

If this answered your queries, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

0 comments

1 additional answer

Your answer

Swaroop Kolli 5,285 Reputation points Microsoft External Staff Moderator

2025-08-04T18:05:51.15+00:00

Hello @Matt Haggard,

Please check the trusted signing account name matches the one from the output metadata-

Please let us know if this is matching with the one in the metadata. If it is not matching, please change the field and let us know the behavior. Also please check if Trusted Signing role (Trusted Signing Certificate Profile Signer and Trusted Signing Identity Verifier) is assigned to the identity.

If there is an app registration associated with this, please make sure you navigate to app registration and grant admin consent for all API permissions.
Matt Haggard 40 Reputation points

2025-08-04T19:25:56.01+00:00

The name in CodeSigningAccountName in the metadata file matches the Name in Trusted Signing Accounts. They are both "com-onepartrain"

As best I can tell, I have the right roles. I go to Trusted Signing > [my account] > Access control (IAM) > Role assignments and I see my username with the roles Owner, Trusted Signing Certificate Profile Signer and Trusted Signing Identity Verifier.

As far as I can tell I have admin consent granted (though I can click the "Grant admin consent..." button again.

I'm not sure how the App registration I have knows how to be associated with my user, though. I don't see anything anywhere that indicates that the app registration belongs to my user or has the same permissions as my user.
Matt Haggard 40 Reputation points

2025-08-05T15:55:01.17+00:00

Swaroop, thank you! That appears to have been the issue. I would never have guessed that I could add the Role to the App Registration. If you have the power to change the UI, please list app registrations in the default list of things as shown here:
Swaroop Kolli 5,285 Reputation points Microsoft External Staff Moderator

2025-08-05T16:06:33.62+00:00

Hello @Matt Haggard,

That is a great news that the issue is resolved. I had posted my answer and if this answered your queries, please click "Accept Answer" and kindly upvote it.

Answer 1

Meha-MSFT 2,460 Microsoft Employee Moderator

https://learn.microsoft.com/en-us/azure/trusted-signing/faq#common-error-codes-and-mitigations

Matt Haggard 40 Reputation points

2025-08-04T20:31:24.8866667+00:00
That link includes a very generic list. I've added my questions and follow-up to that list in italics.

Check your Trusted Signing role. What am I checking?

Check the Trusted Signing account name and the Trusted Signing certificate profile name in your metadata.json file. I've checked these.

Check the dlib and dlib path. When I change the path to garbage, I get a different error.

Install C++ Redistributables from https://docs.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170.

Check your .NET version, dlib version, and Windows SDK version. What version should these be?

Check if the Trusted Signing role is assigned to the identity that's trying to sign the file. How do I check this?

Check if the corresponding identity validation has a status of Completed. It does

Verify whether you access the Trusted Signing endpoint from this virtual machine or computer. Try executing the action on a different virtual machine or computer. The error might indicate a network issue. I only have one machine, but I don't think it's a network issue as I can get different errors by doing different things.

For Private Trust scenarios 403: The user object ID that does the signing is different from the user object ID that calls Get-azCodeSigningRootCert. The appropriate object ID must have the role Trusted Signing Certificate Profile Signer. How do I check this?
Meha-MSFT 2,460 Reputation points Microsoft Employee Moderator

2025-08-04T21:05:07.21+00:00
Trusted Signing Certificate Profile Signer role - we'll be sure to call this out specifically.

Were you able to download the redistirbutables - don't see a response against.

For the .Net versions, dlib versions - make sure it's the latest from the links provided here - https://learn.microsoft.com/en-us/azure/trusted-signing/how-to-signing-integrations#trusted-signing-client-tools-installer

To check the role, go to your TS account > Access Control (IAM) -> if the identity/service principal that's trying to sign has the Trusted Signing Certificate Profile Signer role. https://learn.microsoft.com/en-us/azure/trusted-signing/tutorial-assign-roles
Swaroop Kolli 5,285 Reputation points Microsoft External Staff Moderator

2025-08-05T01:44:10.98+00:00

Hello @Matt Haggard,

Please add the roles Trusted Signing Certificate Profile Signer and Trusted Signing Identity Verifier to the App Registration Object and let us know the behavior.

You can do this by navigating to the Trusted Signing account > add role assignment and add the two roles to the service principal by searching with the app registration name.