6.6 KiB
title, description, keywords, ms.assetid, ms.prod, ms.mktglfcycl, ms.sitesec, ms.pagetype, ms.localizationpriority, audience, ms.collection, author, ms.reviewer, ms.author, manager, ms.date, ms.technology
| title | description | keywords | ms.assetid | ms.prod | ms.mktglfcycl | ms.sitesec | ms.pagetype | ms.localizationpriority | audience | ms.collection | author | ms.reviewer | ms.author | manager | ms.date | ms.technology |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Create a code signing cert for Windows Defender Application Control (Windows) | Learn how to set up a publicly issued code signing certificate, so you can sign catalog files or WDAC policies internally. | security, malware | 8d6e0474-c475-411b-b095-1c61adb2bdbb | m365-security | deploy | library | security | medium | ITPro | M365-security-compliance | jsuther1974 | isbrahm | dansimp | dansimp | 02/28/2018 | windows-sec |
Optional: Create a code signing cert for Windows Defender Application Control
Applies to:
- Windows 10
- Windows 11
- Windows Server 2016 and above
Note
Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the Windows Defender Application Control feature availability.
As you deploy Windows Defender Application Control (WDAC), you might need to sign catalog files or WDAC policies internally. To do this signature, you'll either need a publicly issued code signing certificate or an internal CA. If you've purchased a code-signing certificate, you can skip this topic and instead follow other topics listed in the Windows Defender Application Control Deployment Guide.
If you have an internal CA, complete these steps to create a code signing certificate. Only RSA algorithm is supported for the code signing certificate, and signatures must be PKCS 1.5 padded. ECDSA isn't supported.
-
Open the Certification Authority Microsoft Management Console (MMC) snap-in, and then select your issuing CA.
-
When connected, right-click Certificate Templates, and then click Manage to open the Certification Templates Console.
Figure 1. Manage the certificate templates
-
In the navigation pane, right-click the Code Signing certificate, and then click Duplicate Template.
-
On the Compatibility tab, clear the Show resulting changes check box. Select Windows Server 2012 from the Certification Authority list, and then select Windows 8 / Windows Server 2012 from the Certificate recipient list.
-
On the General tab, specify the Template display name and Template name. This example uses the name WDAC Catalog Signing Certificate.
-
On the Request Handling tab, select the Allow private key to be exported check box.
-
On the Extensions tab, select the Basic Constraints check box, and then click Edit.
-
In the Edit Basic Constraints Extension dialog box, select Enable this extension, as shown in Figure 2.
Figure 2. Select constraints on the new template
-
If a certificate manager is required to approve any issued certificates, on the Issuance Requirements tab, select CA certificate manager approval.
-
On the Subject Name tab, select Supply in the request.
-
On the Security tab, verify that whatever account will be used to request the certificate has the right to enroll the certificate.
-
Click OK to create the template, and then close the Certificate Template Console.
When this certificate template has been created, you must publish it to the CA published template store. To do so, complete the following steps:
-
In the Certification Authority MMC snap-in, right-click Certification Templates, point to New, and then click Certificate Template to Issue, as shown in Figure 3.
Figure 3. Select the new certificate template to issue
A list of available templates to issue appears, including the template you created.
-
Select the WDAC Catalog signing certificate, and then click OK.
Now that the template is available to be issued, you must request one from the computer running Windows 10 and Windows 11 on which you create and sign catalog files. To begin, open the MMC, and then complete the following steps:
-
In MMC, from the File menu, click Add/Remove Snap-in. Double-click Certificates, and then select My user account.
-
In the Certificates snap-in, right-click the Personal store folder, point to All Tasks, and then click Request New Certificate.
-
Click Next twice to get to the certificate selection list.
-
In the Request Certificate list, select your newly created code signing certificate, and then select the blue text that requests additional information, as shown in Figure 4.
Figure 4. Get more information for your code signing certificate
-
In the Certificate Properties dialog box, for Type, select Common name. For Value, select ContosoDGSigningCert, and then click Add. When added, click OK.
-
Enroll and finish.
Note
If a certificate manager is required to approve any issued certificates and you selected to require management approval on the template, the request will need to be approved in the CA before it will be issued to the client.
This certificate must be installed in the user's personal store on the computer that will be signing the catalog files and code integrity policies. If the signing is going to be taking place on the computer on which you just requested the certificate, exporting the certificate to a .pfx file won't be required because it already exists in your personal store. If you're signing on another computer, you'll need to export the .pfx certificate with the necessary keys and properties. To do so, complete the following steps:
-
Right-click the certificate, point to All Tasks, and then click Export.
-
Click Next, and then select Yes, export the private key.
-
Choose the default settings, and then select Export all extended properties.
-
Set a password, select an export path, and then select WDACCatSigningCert.pfx as the file name.
When the certificate has been exported, import it into the personal store for the user who will be signing the catalog files or code integrity policies on the specific computer that will be signing them.