I made a CA (imported into CurrentUser/Root) and used it to make signing certificate (imported into CurrentUser/TrustedPeople). It says “This certificate is OK.” and it signs my certificate fine but it get “This app package’s publisher certificate could not be verified. The root certificate and all immediate certificates of the signature in the app package must be verified 800B010A”

I know one fix is to import the signing certificate into LocalMachine/TrustedPeople but I was wondering if there is something in how I made my certificates that I can change.

winpty openssl genrsa -out ca.key 4096
winpty openssl req -new -x509 -days 365 -key ca.key -out ca.crt -config extfile.cnf
winpty openssl pkcs12 -export -out CACertificate.pfx -inkey ca.key -in ca.crt

winpty openssl genrsa -out client.key.pem 4096
winpty openssl req -new -key client.key.pem -out client.csr
winpty openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -out client.cert.pem -CAcreateserial -days 365 -sha256 -extfile client_extfile.cnf
winpty openssl pkcs12 -export -out clientCertificate.pfx -inkey client.key.pem -in client.cert.pem

makeappx pack /d <source_directory> /p <output_package.appx>
signtool sign /fd SHA256 /a /f <certificate_file.pfx> /p <password> <path_to_appx_file>

CA cnf file

[ req ]
distinguished_name = req_distinguished_name
x509_extensions = v3_ca
prompt = no
default_bits = 4096
default_keyfile = ca.key
default_md = sha256
[ req_distinguished_name ]
CN=kk
O=kk
L=kk
C=kk
[ v3_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
extendedKeyUsage = codeSigning

Client cnf file

[ req ]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no
default_md = sha256
[ req_distinguished_name ]
CN=kk
O=kk
L=kk
C=kk
[ v3_req ]
basicConstraints = critical, CA:FALSE
keyUsage = critical, digitalSignature
extendedKeyUsage = codeSigning
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer