I met an error when upload the signed file 'SignableFile.bin' to add a new certificate

Question

I met an error when upload the signed file 'SignableFile.bin' to add a new certificate

王冲 Chong Wang 30

In Microsoft partner center > account settings > Manage certificates > +Certificate > New certificate

I fllow the 6 steps and do it， but I met an error "We encountered a problem processing the file you uploaded. Please ensure the file you sign and upload is the same file you downloaded." when I upload the signed file.

The sign command is 'signtool sign /v /fd sha256 /tr http://timestamp.digicert.com /td sha256 SignableFile.bin'

Junjie Zhu - MSFT 21,491 Reputation points Microsoft External Staff

2023-08-10T02:27:58.9466667+00:00
Hi @王冲 Chong Wang，

Welcome to Microsoft Q&A!

You can first try the following command to verify the marked file, is there any error?

signtool verify /a SignableFile.bin

Thank you.

王冲 Chong Wang 30

HI @Junjie Zhu - MSFT

Thanks for your help, 

when I use this command 'signtool verify /a SignableFile.bin', there is an error:

File: SignableFile.bin
Index  Algorithm  Timestamp
========================================
SignTool Error: A certificate chain processed, but terminated in a root
        certificate which is not trusted by the trust provider.

Number of errors: 1

But when I use the command 'signtool verify /pa SignableFile.bin' , there is no error:

File: SignableFile.bin
Index  Algorithm  Timestamp
========================================
0      sha256     RFC3161
Successfully verified: SignableFile.bin

I don't know why.

Junjie Zhu - MSFT 21,491 Reputation points Microsoft External Staff

2023-08-10T09:00:07.16+00:00

Hi @王冲 Chong Wang，

I suggest you open a free support ticket here: Contact Us. Go to Contact us tab , find Non-Technical Support - Dashboard and choose SUBMIT AN INCIDENT. You could talk to the store team directly and confirm this behavior. The store team could check the status of your account in the back end.

Thank you.
Patil, Sandeep 35 Reputation points

2023-08-11T21:28:24.1466667+00:00

We are seeing the same issue. This is something recent. We have used the same signing command in the past and it has worked fine. Also the flag "/a" for verification does not seem to use the "Default Verification Policy" and hence the error (probably trying to use the Driver Verification Policy.
王冲 Chong Wang 30 Reputation points

2023-08-14T01:42:18.2733333+00:00

Yes, it worked well last year using the same command, I have contacted Microsoft support for help now and the issue is still pending, you can have a try to submit an incident, refer here " Go to Contact us tab , find Non-Technical Support - Dashboard and choose SUBMIT AN INCIDENT "
Patil, Sandeep 35 Reputation points

2023-08-14T15:44:26.0033333+00:00

We have opened a support request too, but no activity on it yet.
Johnson_75 0 Reputation points

2023-08-15T13:56:12.44+00:00

Same thing here. If anyone has solved it, please post the solution.
Patil, Sandeep 35 Reputation points

2023-08-15T16:08:13.35+00:00

I have received an email update on my ticket stating that this is a known issue and is being worked on by the engineering team. Hopefully we will have a resolution soon.
Johnson_75 0 Reputation points

2023-08-15T16:28:57.2333333+00:00

Hi, @Patil, Sandeep. Thank you for your updating.

SoManyBugs 1

I encountered the same problem. It's astonishing that this problem has been there for months and MS did not address it yet!

"C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\signtool.exe" verify /a SignableFile.bin
File: SignableFile.bin
Index  Algorithm  Timestamp
========================================
SignTool Error: A certificate chain processed, but terminated in a root
        certificate which is not trusted by the trust provider.

Number of errors: 1

Mehmet 0 Reputation points

2023-08-16T22:46:23.5766667+00:00

Same issue..
Ivan Dubynets 0 Reputation points

2023-08-17T09:20:47.4433333+00:00

We faced the same issue. Also there is no way to delete the existing expired certificate. It seems this functionality is totally broken
Patil, Sandeep 35 Reputation points

2023-08-17T21:50:19.1566667+00:00

@Ivan Dubynets You are correct about the broken expired cert removal. It just errors out on the dialog with some [object Object] message.
Patil, Sandeep 35 Reputation points

2023-08-18T00:15:49.24+00:00

We just got confirmation from Microsoft that they have fixed the issue where the SHA256 hash signatures were being rejected for SignableFile.bin. It is accepting both SHA256 and SHA384 now.
Johnson_75 0 Reputation points

2023-08-18T03:03:02.6+00:00

@Patil, Sandeep. Great! Thanks for letting us know.

1 answer

Your answer

Junjie Zhu - MSFT 21,491 Reputation points Microsoft External Staff

2023-08-10T02:27:58.9466667+00:00

Hi @王冲 Chong Wang，

Welcome to Microsoft Q&A!

You can first try the following command to verify the marked file, is there any error?

signtool verify /a SignableFile.bin

Thank you.
王冲 Chong Wang 30 Reputation points

2023-08-10T02:57:24.4166667+00:00

HI @Junjie Zhu - MSFT

Thanks for your help, when I use this command 'signtool verify /a SignableFile.bin', there is an error: File: SignableFile.bin Index Algorithm Timestamp ======================================== SignTool Error: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Number of errors: 1 But when I use the command 'signtool verify /pa SignableFile.bin' , there is no error: File: SignableFile.bin Index Algorithm Timestamp ======================================== 0 sha256 RFC3161 Successfully verified: SignableFile.bin I don't know why.
Junjie Zhu - MSFT 21,491 Reputation points Microsoft External Staff

2023-08-10T09:00:07.16+00:00

Hi @王冲 Chong Wang，

I suggest you open a free support ticket here: Contact Us. Go to Contact us tab , find Non-Technical Support - Dashboard and choose SUBMIT AN INCIDENT. You could talk to the store team directly and confirm this behavior. The store team could check the status of your account in the back end.

Thank you.
Patil, Sandeep 35 Reputation points

2023-08-11T21:28:24.1466667+00:00

We are seeing the same issue. This is something recent. We have used the same signing command in the past and it has worked fine. Also the flag "/a" for verification does not seem to use the "Default Verification Policy" and hence the error (probably trying to use the Driver Verification Policy.
王冲 Chong Wang 30 Reputation points

2023-08-14T01:42:18.2733333+00:00

Yes, it worked well last year using the same command, I have contacted Microsoft support for help now and the issue is still pending, you can have a try to submit an incident, refer here " Go to Contact us tab , find Non-Technical Support - Dashboard and choose SUBMIT AN INCIDENT "
Patil, Sandeep 35 Reputation points

2023-08-14T15:44:26.0033333+00:00

We have opened a support request too, but no activity on it yet.
Johnson_75 0 Reputation points

2023-08-15T13:56:12.44+00:00

Same thing here. If anyone has solved it, please post the solution.
Patil, Sandeep 35 Reputation points

2023-08-15T16:08:13.35+00:00

I have received an email update on my ticket stating that this is a known issue and is being worked on by the engineering team. Hopefully we will have a resolution soon.
Johnson_75 0 Reputation points

2023-08-15T16:28:57.2333333+00:00

Hi, @Patil, Sandeep. Thank you for your updating.
SoManyBugs 1 Reputation point

2023-08-16T08:48:13.62+00:00

I encountered the same problem. It's astonishing that this problem has been there for months and MS did not address it yet!

"C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\signtool.exe" verify /a SignableFile.bin File: SignableFile.bin Index Algorithm Timestamp ======================================== SignTool Error: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Number of errors: 1
Mehmet 0 Reputation points

2023-08-16T22:46:23.5766667+00:00

Same issue..
Ivan Dubynets 0 Reputation points

2023-08-17T09:20:47.4433333+00:00

We faced the same issue. Also there is no way to delete the existing expired certificate. It seems this functionality is totally broken
Patil, Sandeep 35 Reputation points

2023-08-17T21:50:19.1566667+00:00

@Ivan Dubynets You are correct about the broken expired cert removal. It just errors out on the dialog with some [object Object] message.
Patil, Sandeep 35 Reputation points

2023-08-18T00:15:49.24+00:00

We just got confirmation from Microsoft that they have fixed the issue where the SHA256 hash signatures were being rejected for SignableFile.bin. It is accepting both SHA256 and SHA384 now.
Johnson_75 0 Reputation points

2023-08-18T03:03:02.6+00:00

@Patil, Sandeep. Great! Thanks for letting us know.

Answer 1

Patil, Sandeep 35

Can you folks try using SHA384 instead of SHA256 and try again (the /fd parameter) ? Looks like they have changed their code to reject SHA256 hash signatures for the SignableFile.bin.

Mehmet 0 Reputation points

2023-08-17T22:33:36.3366667+00:00

Thank you so much Patil Sandeep it works with SHA384!!!!!!!!!!!!!!!!!
王冲 Chong Wang 30 Reputation points

2023-08-18T01:02:26.3+00:00

This issue is solved, thank you all very much for your help.🤝
SoManyBugs 1 Reputation point

2023-08-18T02:35:31.8866667+00:00

Thanks
Ivan Dubynets 0 Reputation points

2023-08-18T15:00:44.67+00:00

thank you! You saved a lot of time and probably release of our project!

Share via

I met an error when upload the signed file 'SignableFile.bin' to add a new certificate

1 answer

Your answer