我有一个类似的问题，我的计算机名已经改变，证书已经过期。我能够通过创建一个新的测试证书来解决这个问题。

在Visual Studio中，右键单击解决方案资源管理器中的项目。选择properties。选择“在属性窗口中签名”。点击“创建测试证书....”。输入测试证书的密码信息，单击“确定”。

我有这个问题，我不完全确定下面的哪一步使它工作，但希望这有助于其他人…这就是我所做的:

Install the downloaded certificate (.crt) into certificates (I put it into “personal” store) - right click on .crt file and click Install Certificate. Run certmgr.msc and export the certificate (found in whichever store you used in the 1st step) as a pfx file including private key and extended properties Use the exported .pfx file when signing your project Example signtool: signtool sign /f "c:\mycert.pfx" /p mypassword /d "description" /t http://timestamp.verisign.com/scripts/timstamp.dll $(TargetPath) where the password is the same as provided during Export

我通过使用/sm标志来指定查找机器存储而不是默认的“我的(本地用户)”存储来解决这个问题。此外，使用/debug可以帮助打开signtool的调试功能。

我有同样的“私钥过滤后，0 certs被留下”的消息，我花了太多的时间试图弄清楚这条消息的意思。

问题是我在Windows证书存储中错误地安装了证书，因此没有与代码签名证书相关联的私钥。

我应该做的是:

Using either Firefox or Internet Explorer, submit the request to the issuer. This generates a PRIVATE KEY which is stored silently by the browser (a dialog appears for a fraction of a second in Firefox). Note that other browsers may not work: your life is too short to find out if they do. Submit the request, jump through the issuer's validation hoops and loops, sacrifice a goat, pray to the gods, submit a signed statement from your great grandparents, etc. Download the certificate (.crt) and import it into the same browser. The browser now has both the private key and the certificate. Export the certificate from the browser as a Personal Information Exchange (.p12) file. You will be asked to supply a password to protect this file. Keep a backup copy of the .p12 file. Run the Certificate Manager (certmgr.msc), right click on the Personal certificate store, select All Tasks/Import... and import the .p12 file into Windows. You will be asked for the password you used to protect the file. At this point, depending upon your security requirements, you can mark the key as exportable so you can restore a copy from the Windows store. You can also mark that a password is required before use if you want to break batch scripts. Run signtool successfully, breathe a sigh of relief, and ponder how much of your life you have wasted due to bad error messages and poor or missing documentation.

尝试使用/debug。1,2如:

signtool sign /debug /f mypfxfile.pfx /p <password> (mydllexectuable).exe

它将帮助您了解发生了什么。你应该得到这样的输出:

The following certificates were considered:
    Issued to: <issuer>
    Issued by: <certificate authority> Class 2 Primary Intermediate Server CA
    Expires:   Sun Mar 01 14:18:23 2015
    SHA1 hash: DD0000000000000000000000000000000000D93E

    Issued to: <certificate authority> Certification Authority
    Issued by: <certificate authority> Certification Authority
    Expires:   Wed Sep 17 12:46:36 2036
    SHA1 hash: 3E0000000000000000000000000000000000000F

After EKU filter, 2 certs were left.
After expiry filter, 2 certs were left.
After Private Key filter, 0 certs were left.
SignTool Error: No certificates were found that met all the given criteria.

您可以查看是哪个过滤器导致您的证书无法工作，或者是否没有考虑证书。

我改变了哈希值和其他信息，但你应该明白。

1请注意:signtool对/debug选项放置的位置有特殊要求。它需要跟在sign语句后面。 另外注意:/debug选项只适用于某些版本的signtool。WDK版本有这个选项，而Windows SDK版本没有。

我在控制台应用程序开发中遇到了同样的问题，作为一个快速的解决方案，

那就去项目物业，

点击签名选项卡，取消选中“签名ClickOnce清单”。

图片描述:

供你参考，你也可以看到这个少于一分钟的视频解决方案。上面的图片是从视频中截取的。