Digitally signing ArcGIS Pro AddIns using a certificate stored in Azure Key Vault

[SébastienBlier]

Hi,

We bought an Azure Key Vault EV Code Signing Certificate from SignMyCode (DigiCert certificate) and we succesfully import the certificate in our Azure Key Vault and we are able to sign our normal .exe files using the AzureSignTool.

I understand we need to use the utility ArcGISSignAddIn.exe to sign the add-in but I can't make it work with the certificate stored in the Azure Key Vault.

From the Azure  Portal, I exported the certificate as .pfx file.

Then I ran this command line:

ArcGISSignAddIn Test.esriAddinX" /c:\test.pfx

And I got that error: Signing key is not loaded.

I also tried to import the .pfx to the windows certificate store, then ran the ArcGISSignAddIn.exe without parameters and from the UI I selected my addin file and then from the store certificate list I choosed the certificate i just imported and the same result: Signing key is not loaded.

I also tried to use the AzureSignTool directly but I received an unsupported file type.

Anybody have an idea on how to sign and add-in from the Azure Key Vault ? ESRI have any documentation on using the sign utility with azure key vault certificate ?

Thanks

[SébastienBlier]

Update on my previous post, according to this document:

https://github.com/Esri/arcgis-pro-sdk/wiki/ProGuide-Digitally-signed-add-ins-and-configurations#cod...

*If you are using a certificate imported from an HSM, the HSM must be connected to the physical machine on which the signing is being performed to provide the necessary private key to complete the signing process. A cloud based HSM will perform in a similar fashion via a secure connection. To disable any password prompt, please refer to the instructions provided by your Digital Certificate vendor on how to cache user/pwd credentials**.

I now understand that the ArcGISSignAddIn utility need to connect to the HSM to get the private key. My certificate is stored in an Azure Key Vault, how do I create that "secure connection" to the Azure Key Vault so the utility can retrieve the private key ? In AzureSignTool, we can specify clientId, secret, vault uri, etc. Why not in ArcGISSignAddIn utility ?