title: How to dual sign a binary with Authenticode?
body: <p><strong>Short question</strong></p>
  
  <p>How can I get information about multiple code signing certificates from an executable (.EXE/.DLL)?</p>
  
  <p><strong>Expected answer</strong></p>
  
  <p>The final accepted answer should propose a way to get all certificates in C#. Concept / pseudo code is ok, I don't expect you to write the full source.</p>
  
  <p>For an intermediate answer suggesting a tool, please see <a href="https://security.stackexchange.com/questions/50959/how-to-check-executable-code-signing-signatures">my question on Security.StackExchange</a>.</p>
  
  <p><strong>Long question</strong></p>
  
  <p>I am researching whether we could use multiple code signing certificates on a plugin (.DLL) to check whether it has been officially tested or not. This is the procedure:</p>
  
  <ul>
  <li>the plugin DLL is signed by the vendor just like any other application</li>
  <li>the plugin DLL comes into a test lab and undergoes a set of tests</li>
  <li>the plugin DLL gets signed again by the test lab so that the application using the DLL can find out whether it is using a tested plugin or not</li>
  </ul>
  
  <p>It seems possible to sign a DLL a second time using</p>
  
  <pre><code> signtool /v /f &lt;pfx&gt; /as &lt;dll&gt;
  </code></pre>
  
  <p>Indications that this may have worked:</p>
  
  <ul>
  <li>the file increases in size</li>
  <li>the tool prints a success message</li>
  </ul>
  
  <p>However, there are some issues showing the second signature:</p>
  
  <ul>
  <li>although Windows Explorer says "Signature list", it shows only one certificate</li>
  <li>the C# <code>X509Certificate.CreateFromSignedFile()</code> method can only return one certificate</li>
  </ul>
  
  <p>At the moment I'm actually trying my code on an EXE file rather than a DLL file, but that shouldn't matter. The EXE is already signed with a trusted root certificate and a timestamp. The second signature is created with <a href="https://stackoverflow.com/questions/84847/how-do-i-create-a-self-signed-certificate-for-code-signing-on-windows">my own certificate following these steps</a> currently without a timestamp.</p>
  
  <p>Things I did before asking the question:</p>
  
  <ul>
  <li>search on Stackoverflow for existing answers</li>
  <li>search for tools on Google</li>
  </ul>
  
  <p>The only related question I found so far is <a href="https://stackoverflow.com/questions/20601575/how-does-one-correctly-dual-sign-code-with-a-timestamp">How does one correctly dual-sign with a timestamp</a> but it doesn't have an answer.</p>