SignTool: How to identify a specific certificate?

Question

I have two USB tokens with GlobalSign certificates, as I develop software for different customers which want their respective company names as code signature. How do I tell SignTool which certificate to use in the makefile after the link command? (Until now, I just plug in only one of the tokens when calling the corresponding make file, requiring physical change when necessary.) My certificate list is shown by certmgr as follows: certmgr screenshot

I have read https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool but did not identify the correct parameter to identify the wanted certificate.

Answer 1

You can try using the /n parameter to specify the partial name of the certificate subject. For example if the signing certificate was issued to "ACME Corp", use /n ACME. You can also select the certificate by hash using the /sha1 parameter, but it implies updating the build when the certificate is renewed.