How To Integrate USB Token Code Signing Certificate With Build Server (Windows Server 2012 R2 Virtual Machine running on Hyper-V)

Question

We want to sign all of our build artifacts - dlls, exe files, setup packages etc.

This was working fine with post-build scripts for the last two years. But since February 2017 all CAs have introduced some hardware options (USB Token or HSMs.

So the idea is somehow to attach the USB token to our Hyper-V but as far as I know USB port is not available to the Guest OS out of the box.

So, what is your experience with this?

Answer 1

Some of the same problems are adressed in this stackoverflow question: Automate Extended Validation (EV) code signing

Perhaps the problem can be solved using Remote signing (one on the answers to the above post) https://stackoverflow.com/a/35369264/34857

I have just read that some Certificates, can be exported, and the problem can be solved by that. As I read it, this is how node.js does it (https://github.com/nodejs/build/issues/874)