Skip to main content

Interface: WindowsSigntoolSigningConfig

Sign with a certificate file (.pfx / .p12) or with a certificate from the Windows certificate store, using Microsoft signtool.exe on Windows and osslsigncode on macOS/Linux. This is the default mode when win.sign is unset. Supply the certificate one of four ways: a file via certificateFile (or the WIN_CSC_LINK env var), or a store lookup via certificateSubjectName or certificateSha1.

Extends​

  • WindowsSigningSharedOptions

Properties​

additionalCertificateFile?​

readonly optional additionalCertificateFile?: string | null

Path to an additional certificate file (typically an intermediate / cross-signing CA certificate) whose contents are added to the signature block via signtool's /ac flag. Use this when the signing certificate's full chain is not already present on target machines and you want it embedded in the signature so the chain can be validated.

Inherited from​

WindowsSigningSharedOptions.additionalCertificateFile

certificateFile?​

readonly optional certificateFile?: string | null

Path to the PKCS#12 certificate file (.pfx or .p12) holding both the signing certificate and its private key. Passed to signtool via /f (or osslsigncode via -pkcs12).

Prefer supplying this out-of-band via the WIN_CSC_LINK (or CSC_LINK) environment variable instead of hardcoding a path — that variable also accepts an https:// URL or a base64-encoded certificate, which is safer and more convenient on CI. See Code Signing.

certificatePassword?​

readonly optional certificatePassword?: string | null

The password protecting the private key in certificateFile. Passed to signtool via /p (or osslsigncode via -pass).

Prefer the WIN_CSC_KEY_PASSWORD (or CSC_KEY_PASSWORD) environment variable so the secret never lands in your build configuration.

certificateSha1?​

readonly optional certificateSha1?: string | null

Select the signing certificate from the Windows certificate store by its SHA-1 thumbprint, instead of pointing at a .pfx file. electron-builder looks the certificate up in the store and signs with /sha1 <thumbprint> /s <store>. Like certificateSubjectName, this suits EV certificates backed by a hardware token; if both are set, both must resolve to the same certificate.

Works only on Windows (or macOS with Parallels Desktop, via the bundled Windows VM).

certificateSubjectName?​

readonly optional certificateSubjectName?: string | null

Select the signing certificate from the Windows certificate store by (a substring of) its subject name, instead of pointing at a .pfx file. electron-builder enumerates the installed code-signing certificates, picks the match, and signs by its thumbprint (/sha1 <thumbprint> /s <store>). Required for EV (Extended Validation) certificates, whose private keys live on a hardware token and cannot be exported to a file.

Works only on Windows (or macOS with Parallels Desktop, via the bundled Windows VM).

publisherName?​

readonly optional publisherName?: string | string[] | null

The publisher name(s) to associate with the signature, written exactly as the subject appears in your code signing certificate. May be a single string or an array — an array is useful when rotating certificates, so updates signed by either the old or the new certificate still verify.

This value is not a signtool argument; it is consumed in two places:

  • Update verification — when verifyUpdateCodeSignature is enabled, it is written into app-update.yml and electron-updater checks it against the certificate that signed each downloaded update.
  • AppX / MSIX identity — the package Publisher attribute must equal the certificate subject, so electron-builder derives it from this value (or the certificate) to keep them in sync; a mismatch makes packaging fail with ERROR_BAD_FORMAT.

Defaults to the Common Name (CN) extracted from your code signing certificate. Set to null to opt out.

See​

https://github.com/electron-userland/electron-builder/issues/1187#issuecomment-278972073

Inherited from​

WindowsSigningSharedOptions.publisherName

rfc3161TimeStampServer?​

readonly optional rfc3161TimeStampServer?: string | null

The URL of the RFC 3161 timestamp server, used for SHA-256 and nested/appended signatures (signtool's /tr flag). Timestamping records when the file was signed so the signature stays valid after the signing certificate expires. Ignored when the build runs with ELECTRON_BUILDER_OFFLINE=true.

Default​

http://timestamp.digicert.com

Inherited from​

WindowsSigningSharedOptions.rfc3161TimeStampServer

sign?​

readonly optional sign?: string | CustomWindowsSign | null

A custom signing hook that replaces electron-builder's built-in signtool / osslsigncode invocation. Provide a function, or the path / module id of a file that exports a sign function (resolved relative to the project, then as a module).

The hook is invoked once per signing pass (i.e. once per entry in signingHashAlgorithms) and receives a configuration object describing the file to sign (path), the resolved certificate info (cscInfo), the current hash, and whether this pass is a nested signature (isNest), plus a computeSignToolArgs(isWin) helper that returns the default arguments electron-builder would otherwise have used. Use this to integrate an external or cloud signing service. See Code Signing.

Inherited from​

WindowsSigningSharedOptions.sign

signingHashAlgorithms?​

readonly optional signingHashAlgorithms?: ("sha256" | "sha1")[] | null

The digest (hash) algorithms to sign with, applied via signtool's /fd flag (or osslsigncode's -h). One signing pass runs per entry, in order; listing more than one dual-signs the file, with each additional signature appended as a nested signature (signtool /as). Signing with both sha1 and sha256 lets a single binary validate on legacy (pre-SHA-2) Windows as well as modern Windows.

Some targets override this: .msi cannot be dual-signed (a single hash is used) and AppX/MSIX is always sha256 only.

Default​

['sha1', 'sha256']

Inherited from​

WindowsSigningSharedOptions.signingHashAlgorithms

timeStampServer?​

readonly optional timeStampServer?: string | null

The URL of the legacy Authenticode timestamp server, used for SHA-1 signatures (signtool's /t flag). This is also the timestamp server used by osslsigncode (-t) when signing on macOS/Linux. See rfc3161TimeStampServer for SHA-256 / nested signatures. Ignored when the build runs with ELECTRON_BUILDER_OFFLINE=true.

Default​

http://timestamp.digicert.com

Inherited from​

WindowsSigningSharedOptions.timeStampServer

type​

readonly type: "signtool"

Discriminator selecting the default file/store signing mode.