How do I sign windows software with a certificate on a yubikey?

Question

Previously, I would insert the yubikey into a USB port and then run ./signtools.exe from powershell with the relevant options. I would then be prompted to enter my PIN.

I have tried to do this on my new computer and now I get the error

"SignTool Error: No certificates were found that met all the given criteria."

I have installed the Yubikey manager and the certificate is there under PIV, unexpired.

Answer 1

If you struggle with signtool you can try Jsign which supports Yubikeys.

jsign --storetype YUBIKEY --storepass 123456 --certfile full-chain.pem application.exe

If there is a problem with the certificate or the key it should display a meaningful error message.

(disclaimer: I'm the author of this project)