SignTool unexepected internal error

Question

I am running SignTool with the following command: signtool sign /f keyfile.pfx /p mypassword pathToMsiFile.msi and i get the following error:

SignTool Error: An unexpected internal error has occurred. Error information: "Error: Store::ImportCertObject() failed." (-2146893792/0x80090020)

It worked just until a day ago, and i have no idea what might have changed...

Any ideas would be great, thanks!

---

I managed to fix it. Apperantly the user was corrupted.

after fixing the user using this KB from microsoft everything became right again.

Bacciferous

Answer 1

I managed to fix it. Apperantly the user was corrupted.

after fixing the user using this KB from microsoft everything became right again.

Bacciferous

Answer 2

I had the same issue but only when I'm trying to sign it under IIS/PHP script. When I run PHP from the console it's OK. And here there were no issue with account. Only one thing helped me - changing Anonymous Authentication Credentials for Site/application from Specific USER to Application pool identity.

Heartstricken

Answer 3

None of the suggested answers worked for me using Windows 2008 R2 and IIS 7.5. What did work was to change a setting for the application pool. Here is what works on IIS 7.5.

1. Select your application pool and click Advanced Settings
2. Under Process Model, change Identity to LocalSystem

This is the only thing that worked for me, hopefully it will help others down the road.

Lancet

Don't set your AppPool to run as LocalSystem identity. It is not safe! This solves it: https://mcmap.net/q/1730426/-signtool-unexepected-internal-error – Jokester

Answer 4

I'm not sure if setting your Application Pool to run as the LocalSystem is a good idea from the security standpoint. One way to fix this error is to enable Load User Profile in Advanced settings for the Application Pool. Don't ask how long it took me to find it out...

Here's more details.

Jokester

Answer 5

I was also experiencing this error within a web application which was using an IIS web application pool with domain credentials, but the "Load User Profile" was set to false. Once I set it to true, signtool.exe worked without issues.

Cognation