title: Generating a Certificate for signing Universal Windows Platform (UWP) Apps
body: <p>I'm trying to generate a certificate suited for signing a Microsoft Universal Windows Platform (UWP) application.  I have one certificate that works that I self-signed and one issued by my company's internal certificate Authority based on a CSR (certificate request) file that I crafted and submitted to them.  </p>
  
  <p>To generate the self-signed cert, I used the following powershell command</p>
  
  <pre><code>New-SelfSignedCertificate -Type Custom -Subject "&lt;full certificate DN&gt;" -KeyUsage DigitalSignature -FriendlyName "MyFriendlyName" -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3", "2.5.29.19={text}")
  </code></pre>
  
  <p>To generate the cert issued by our internal CA, I created A CSR with the same attributes:</p>
  
  <pre><code>KeyUsage: Digital Signature
  ExtendedKeyUsage: CodeSigning (1.3.6.1.5.5.7.3.3)
  2048 bit key
  algo: AES-SHA256
  </code></pre>
  
  <p>With most of the other properties defaulted.</p>
  
  <p>As I said, the self-signed cert works, the CA-issued cert will not be accepted by Visual Studio.  Here is the error I get when I try to assign the CA-issued cert for signing:</p>
  
  <blockquote>
    <p>The Manifest Designer could not import the certificate.
    The certificate you selected is not valid for signing because it is
    either expired or has another issue. For more information, see
    <a href="http://go.microsoft.com/fwlink/?LinkID=241478" rel="nofollow noreferrer">http://go.microsoft.com/fwlink/?LinkID=241478</a>.</p>
  </blockquote>
  
  <p><strong>Edit - Note: CA Root and Intermediate certs are installed on the machines in the appropriate cert stores</strong></p>
  
  <p>Here are the properties of the certificates side-by-side.  <strong>Is there any way to know what is specifically wrong with the failing certificate?</strong> I feel like I've met all the UWP signing requirements.</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>Things get stranger.  These steps work:</p>
  
  <ol>
  <li>Right Click and "Publish" my UWP app from Solution Explorer</li>
  <li>Choose not to sign the package at the time of publishing</li>
  <li>Sign the package via command line with SignTool.exe, using the proper Thumbprint (SHA) for my CA-Issued certificate, it works! </li>
  </ol>
  
  <p>Here is my SignTool command line:</p>
  
  <pre><code>"C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x64\signtool.exe" sign /v /fd sha256 /sha1 &lt;my CA-issued cert thumbprint&gt; "path-to-my-unsigned.msix"
  </code></pre>
  
  <p>Output from Signtool with /v (verbose):</p>
  
  <pre><code>The following certificate was selected:
      Issued to: &lt;my org&gt;
      Issued by: &lt;my internal CA name&gt;
      Expires:   Mon Apr 30 11:41:36 2035
      SHA1 hash: &lt;CA-Issued cert hash&gt;
  
  Done Adding Additional Store
  Successfully signed: path-to-my-app.msix
  
  Number of files successfully Signed: 1
  Number of warnings: 0
  Number of errors: 0
  </code></pre>
  
  <p><strong>So the question still stands, why won't Visual Studio accept my CA-issued cert as a valid signing cert even though I can use it to sign manually with SignTool.exe?</strong></p>
  
  <p><strong>END UPDATE</strong></p>
  
  <p><a href="https://i.stack.imgur.com/uCCYR.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/uCCYR.png" alt="enter image description here"></a></p>