Video Screencast Help

Certificate password in Windows Installer Editor

Created: 28 Jul 2013 • Updated: 30 Jul 2013 | 4 comments
This issue has been solved. See solution.

Hi all, its been a long time since I posted here.

A .WSI or .MSI make use of Digital Signature and using the Signtool.exe with Personal Information Exchange (.pfx) option, compiled it and at the end of compilation process, it prompt for the certificate password. My question, does it stored the certificate password somewhere in the setup file (either EXE or MSI)?

If NO, then it's ok. If YES, where and how to look for the password?

Thank you.

Operating Systems:
Discussion Filed Under:

Comments 4 CommentsJump to latest comment

EdT's picture

Are you using a public certificate such as Verisign or a certificate you have created yourself?

I assume the certificate password refers to the actual certificate you are using, but I believe this just confirms that you have the right to use the certificate, and is not actually involved in any future key validation operations.

If your issue has been solved, please use the "Mark as Solution" link on the most relevant thread.

SOLUTION
eastwest's picture

I'm using public certificate.

EdT, so the setup file will not store the password, which mean that there's no way for end user (or hacker) to know about the certificate password.

Thanks.

EdT's picture

Correct - the ability to easily recover data about a certificate would negate the whole point of signing anything.

If your issue has been solved, please use the "Mark as Solution" link on the most relevant thread.