title: How to create PFX with my chain of certificates?
body: <p>i'm applying a digital signature to my executable. Using <code>signtool</code> on Windows XP or Windows Vista:</p>
  
  <pre><code>&gt;signtool.exe sign /f "avatar.pfx" MyApp.exe
  </code></pre>
  
  <p>automatically included the entire certification chain in the digital signature.</p>
  
  <p>Starting with Windows 7 the entire certification chain <a href="https://stackoverflow.com/questions/6575424/how-to-include-entire-certification-path-when-signing-code-with-signtool">is</a> <a href="https://stackoverflow.com/questions/2814233/how-can-i-sign-an-activex-control-with-a-code-signing-certificate-and-be-a-verifi">no</a> <a href="http://www.pcreview.co.uk/forums/signing-winforms-clickonce-app-certificate-chain-t3522706.html" rel="nofollow noreferrer">longer</a> <a href="http://groups.google.com/group/microsoft.public.dotnet.framework.windowsforms/browse_thread/thread/8c46df2acf25d54/4c1c4221f69fa09e?pli=1" rel="nofollow noreferrer">included</a>. <a href="https://stackoverflow.com/questions/6575424/how-to-include-entire-certification-path-when-signing-code-with-signtool/6575763#6575763">You must manually include the certificate</a> that:</p>
  
  <ul>
  <li>signed your key</li>
  <li>signed the certificate that signed your key</li>
  <li>...</li>
  <li>...until there are no more certificates to include</li>
  </ul>
  
  <p><a href="https://stackoverflow.com/questions/6575424/how-to-include-entire-certification-path-when-signing-code-with-signtool">i am told that i have to do this using the <code>/ac</code> switch</a> with the <code>signtool</code> utility. </p>
  
  <p>From <a href="http://msdn.microsoft.com/en-us/library/aa387764%28v=vs.85%29.aspx" rel="nofollow noreferrer">MSDN documentation of <code>signtool</code></a>:</p>
  
  <blockquote>
    <p>/ac <em>FileName</em><br>
    Specifies a file that contains an additional certificate to add to the signature block.</p>
  </blockquote>
  
  <p>How do i get the filename of the certificate that signed my certificate?</p>
  
  <p>It's more confusing because i don't have any such file. i have my digitally signed executable with no embedded certification chain:</p>
  
  <p><img src="https://i.stack.imgur.com/CJIzv.png" alt="enter image description here"></p>
  
  <hr>
  
  <p>Stackoverflow user <a href="https://stackoverflow.com/users/36754/davidcl">davidcl</a> <a href="https://stackoverflow.com/questions/2814233/how-can-i-sign-an-activex-control-with-a-code-signing-certificate-and-be-a-verifi">had the same question</a>. In this <a href="https://stackoverflow.com/questions/2814233/how-can-i-sign-an-activex-control-with-a-code-signing-certificate-and-be-a-verifi/2836808#2836808">self-answered answer</a> he says that i need to </p>
  
  <blockquote>
    <p>do the signing using a PFX file that contains the root certificate, intermediate certificate, developer certificate, and private key.<br>
    After creating the appropriate PFX file - which was an odyssey in itself...</p>
  </blockquote>
  
  <p>But he doesn't give how he created the PFX that contains the entire certification chain.</p>
  
  <hr>
  
  <h2>See also</h2>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/2814233/how-can-i-sign-an-activex-control-with-a-code-signing-certificate-and-be-a-verifi">How can I sign an ActiveX control with a code signing certificate and be a verified publisher?</a></li>
  <li><a href="http://www.pcreview.co.uk/forums/signing-winforms-clickonce-app-certificate-chain-t3522706.html" rel="nofollow noreferrer">Signing WinForms ClickOnce app with Certificate Chain</a></li>
  <li><a href="http://groups.google.com/group/microsoft.public.dotnet.framework.windowsforms/browse_thread/thread/8c46df2acf25d54/4c1c4221f69fa09e?pli=1" rel="nofollow noreferrer">ClickOnce: Certificate cannot be validated</a></li>
  <li><a href="https://stackoverflow.com/questions/6575424/how-to-include-entire-certification-path-when-signing-code-with-signtool">How to include entire certification path when signing code with signtool?</a></li>
  </ul>