Re: New signtool for signing XPI files

Steve S wrote:

> I am signing with a build of signtool numbered 3.10.

Congratulations!

> When I sign with my company cert it says:
> signtool: PROBLEM signing data (Unknown issuer)

That's a very specific error message.  It means that signtool could
not find all the certs to make a complete certificate chain that
chains all the way up from your certificate to a trusted root.
More below.

> the tree "." was NOT SUCCESSFULLY SIGNED
> 
> When I sign with a test cert it says:
> tree "." signed successfully
> 
> Do you think I need my certificate reissued?  

I would say there is not yet any indication that there is anything
wrong with your cert.

 > What should I ask Thawte to do?

Nothing yet.

There are two likely explanations for the error you received.  Either

1) you don't have a copy of nssckbi.dll in the directory with your
cert and key DBs, or
2) your cert8.db file doesn't contain a copy of the "intermediate" CA
cert that issued your cert.

The command
    certutil -V -n certname -e -d .
should help you determine what's up.  There may be other command line
options needed for that command.  Consult "certutil -H" for the whole
list.


-- 
Nelson B