avoid entering code signing password multiple times

[shelmers]

I renewed our code signing certificate this month and it was delivered as a physical token rather than a .cer or .pfx file. I activated the token so it's now in the local certificate store and it works fine. The only issue is that I'm required to enter the token password half a dozen times when generating the installer.

When the cert is on disk, it's possible to have AI store the password in the installer. Is there a way to do that when using a certificate from the certificate store?

I can export the certificate from the token to a file; is that the best alternative?

Thanks --

[Catalin]

Hello,

When the cert is on disk, it's possible to have AI store the password in the installer

Unfortunately not, due to security reasons.

We have recently investigated this using a YubiKey token and were unable to find a good workaround. We'll try to contact their support team to see whether it's possible to avoid having to input the pin this many times.

Best regards,
Catalin

[shelmers]

Thanks, Catalin. My token is from Sectigo in case you have better luck contacting them for some reason.

[Catalin]

You are always welcome!

And sure, we may try that, but first we wanted to prioritize YubiKey since this was reported more by our customers.

If you'd like, you could contact them since you're a paying customer.

For signing purposes, we use the default SignTool.exe, which comes with the OS. I think they might be able to assist in how to avoid those prompts, perhaps through a special command line or something like that.

Best regards,
Catalin

[shelmers]

Thanks for the suggestion to contact Sectigo -- they responded immediately with exactly what I needed. It turns out there's a setting for this!

You can "Enable Single Logon" which will not prompt you to enter the password every time but it is only valid until screen locks. You can Enable this by opening the SafeNet Authentication Client Tools> Settings icon > Client Settings > Advanced > "Enable Single Logon" and Click Save.

Once it is enabled, the Safenet client asks password once per login session. If the computer is locked, then you have to enter the password for the next session.

However, For regular code signing, We highly recommend disabling this feature as this is not a good practice.

Note that they don't recommend using this setting. However, it is available and using it in a properly controlled environment makes sense to me.

[Catalin]

Thank you for your followup on this and for sharing your solution with us!

I am sure this will be of help for further users facing a similar scenario.

Best regards,
Catalin

[smacl]

Thanks for the suggestion to contact Sectigo -- they responded immediately with exactly what I needed. It turns out there's a setting for this!

You can "Enable Single Logon" which will not prompt you to enter the password every time but it is only valid until screen locks. You can Enable this by opening the SafeNet Authentication Client Tools> Settings icon > Client Settings > Advanced > "Enable Single Logon" and Click Save.

Once it is enabled, the Safenet client asks password once per login session. If the computer is locked, then you have to enter the password for the next session.

However, For regular code signing, We highly recommend disabling this feature as this is not a good practice.

Note that they don't recommend using this setting. However, it is available and using it in a properly controlled environment makes sense to me.

I tried this on my new Yubikey 5 NFC FIPS, checked as follows

C:\TEMP>ykman piv keys info 9a
Key slot: 9A (AUTHENTICATION)
Algorithm: ECCP384
Origin: GENERATED
PIN required for use: ONCE
Touch required for use: NEVER

Doesn't work for me in Advanced Installer 23.8. Wondering if it is the key slot, 9C seems more common for code signing but 9A defaults to ONCE for PIN authentication. Workaround for now is GUI automation as recommended in another thread on here

xObay wrote: ↑Wed Jan 17, 2024 8:13 pm
I found this https://github.com/joseangelmt/AutoInsertPin

I compiled it and tested it and it works. Not the best solution but if you want something to feed in the PIN number whenever the window pops up, this will do the trick.

This allows entry of PIN once per session if you don't supply it on the command line which is ok.

[Catalin]

Hello Shane,

Thank you for your followup on this.

Glad you managed to get this to work.

Best regards,
Catalin