how to select an old version of a certificate

[MaximKolesnikovParsley]

Hello!

I have renewed my certificate and, as a result, there are two versions in the KeyVault.
By default, AzureSignTool takes the newer version. However, I have to sign an .msi with the older version.

According to the Q&A, I should specify the certificate identifier (certificate URI).
https://learn.microsoft.com/en-us/answers/questions/1078341/can-you-use-an-older-version-of-a-certificate-inst

I tried to pass the certificate identifier as a -kvu argument but it didn't work.
"azuresigntool.exe" sign -kvu "https://(name).vault.azure.net/certificates/(cert_name)/eb52f040084f4d94b93b2fbf...." ....

Could someone kindly advise on how to sign a file with an old valid certificate?

Thank you

[vcsjones]

It's not documented in the README (will fix that) but @ConcernedCitizen recently contributed --azure-key-vault-certificate-version that lets you specify the version. See information about it in azuresigntool sign --help

[MaximKolesnikovParsley]

Thank you for the quick reply!

Unfortunately, the main branch doesn't include the fix. There is no KeyVaultCertificateVersion in SignCommand in Program.cs
azuresigntool sign --help doesn't enlist -kvcv / --azure-key-vault-certificate-version.

I've found the argument in question in another branch cert-version-selection.
https://github.com/ConcernedCitizen/AzureSignTool/tree/cert-version-selection

PR a14010f is marked as merged but I don't see the commit in the main branch
I've clonned the repository and got 2 branches: main and cert-version-selection.

Could you merge cert-version-selection in the main branch?

[MaximKolesnikovParsley]

I apologize for copying the response but my old certificate expires on February 24th that makes me desperate.

azuresigntool sign --help doesn't enlist -kvcv / --azure-key-vault-certificate-version because the main branch doesn't include the fix. There is no KeyVaultCertificateVersion in SignCommand in Program.cs

I've found the argument in question in another branch cert-version-selection.
https://github.com/ConcernedCitizen/AzureSignTool/tree/cert-version-selection

PR a14010f is marked as merged but I don't see the commit in the main branch.
I've clonned the repository and got 2 branches: main and cert-version-selection.

Could you merge cert-version-selection in the main branch and publish a new build?