Digitally Signing a Release After It Has Been Built From the Command Line

InstallShield 2014

Project: This information applies to the following project types:

InstallScript
InstallScript Object

As an alternative to having InstallShield sign your application at build time, you can use the iSign application (iSign.exe) to digitally sign a release of an InstallScript project from the command line after you have built the release from the command line.

The iSign application is located in the following directory:

InstallShield Program Files Folder\System

This application uses Microsoft Authenticode technology to create digital signatures for your installation. In order to use this program, you need a digital ID from VeriSign.

When you use the iSign application, you can specify options that are not available in the release build, such as the cryptographic service provider.

The iSign syntax is as follows:

iSign [options] Filename

Filename is the fully qualified file name of your built release’s Data1.hdr file.

Following is a list of the options that you can use with iSign. Note that, unlike other command-line applications, the switch and the argument for the switch should be separated by a space; for example:

iSign.exe -spc "C:\Temp\MyFile.spc" -v "C:\Temp\MyFile.pvk" -p "Test" -cp "Microsoft Base Cryptographic Provider v1.0"

Options for iSign.exe

Option

Description

-spc

Fully qualified file name of the software publishing credentials (.spc) file.

-v

Fully qualified file name of the private key (.pvk) file.

-p

Password for private key file.

-cp

Cryptographic service provider name, for example, "Microsoft Enhanced Cryptographic Provider v1.0".

If the -cp option is not used, iSign tries each of the following service providers to find one that works with the specified private key file:

"Microsoft Base Cryptographic Provider v1.0"
"Microsoft Enhanced Cryptographic Provider v1.0"
"Microsoft Strong Cryptographic Provider"

For a list of cryptographic service providers, see Cryptographic Provider Names in the Platform SDK documentation or at the MSDN Web site. "Microsoft Base Cryptographic Provider v1.0" (MS_DEF_PROV) is appropriate for older certificates; if you are using a recent certificate and iSign fails, try using the other two. Note that the "v1.0" portion is required, even though some SDK documentation does not list it.

If iSign.exe is unable to determine the file to sign, the .spc file, or the .pvk file from the specified command line, the application displays the options (help) screen.