Edit

Share via

Sign a CI policy by using Trusted Signing

  • Article

This article shows you how to sign new code integrity (CI) policies by using the Trusted Signing service.

Prerequisites

To complete the steps in this article, you need:

  • A Trusted Signing account, identity validation, and certificate profile.
  • Individual or group assignment of the Trusted Signing Certificate Profile Signer role.
  • Azure PowerShell in Windows installed.
  • Az.CodeSigning module downloaded.

Sign a CI policy

  1. ⁠Open PowerShell 7.

  2. Optionally, you can create a metadata.json file that looks like this example:("Endpoint" URI value must be a URI that aligns with the region where you created your Trusted Signing account and certificate profile when you set up these resources.)

    {
"Endpoint":"https://xxx.codesigning.azure.net/",
"CodeSigningAccountName":"<Trusted Signing Account Name>",
"CertificateProfileName":"<Certificate Profile Name>"
}

  3. Get the root certificate that you want to add to the trust store:

    Get-AzCodeSigningRootCert -AccountName TestAccount -ProfileName TestCertProfile -EndpointUrl https://xxx.codesigning.azure.net/ -Destination c:\temp\root.cer

    If you're using a metadata.json file, run this command instead:

    Get-AzCodeSigningRootCert -MetadataFilePath C:\temp\metadata.json https://xxx.codesigning.azure.net/ -Destination c:\temp\root.cer

  4. To get the Extended Key Usage (EKU) to insert into your policy:

    Get-AzCodeSigningCustomerEku -AccountName TestAccount -ProfileName TestCertProfile -EndpointUrl https://xxx.codesigning.azure.net/

    If you're using a metadata.json file, run this command instead:

    Get-AzCodeSigningCustomerEku -MetadataFilePath C:\temp\metadata.json

  5. To sign your policy, run the invoke command:

    Invoke-AzCodeSigningCIPolicySigning -accountName TestAccount -profileName TestCertProfile -endpointurl "https://xxx.codesigning.azure.net/" -Path C:\Temp\defaultpolicy.bin -Destination C:\Temp\defaultpolicy_signed.bin -TimeStamperUrl: http://timestamp.acs.microsoft.com

    If you're using a metadata.json file, run this command instead:

    Invoke-AzCodeSigningCIPolicySigning -MetadataFilePath C:\temp\metadata.json -Path C:\Temp\defaultpolicy.bin -Destination C:\Temp\defaultpolicy_signed.bin -TimeStamperUrl: http://timestamp.acs.microsoft.com

Create and deploy a CI policy

For steps to create and deploy your CI policy, see these articles: