<# ================================================================================ Kiwy Signage Player - Self-Signed Certificate Creator ================================================================================ Creates a self-signed code-signing certificate for DEV/TEST machines. IMPORTANT (please read before running): A self-signed certificate, even when trusted locally, does NOT satisfy Smart App Control (SAC). SAC only trusts reputable public CAs. This script is therefore ONLY for development / test PCs where you have admin rights and where SAC is either OFF or the app is run with SAC disabled. For production PCs (SAC ON, no admin), you MUST buy a code-signing cert from a public CA (Sectigo/SSL.com/DigiCert/GlobalSign) and use sign_exe.ps1 with that .pfx. What this does: 1. Creates a self-signed code-signing cert in the Current User store (never expires, exportable so you can move it to the build machine). 2. Exports it to a .pfx (password-protected) so build_win.bat can sign. 3. Asks if you want to trust it on THIS machine (installs to Root + Trusted Publisher + Trusted People) so the player runs without SmartScreen/ Defender prompts on this dev PC. Usage (run as Administrator): .\create_self_signed_cert.ps1 .\create_self_signed_cert.ps1 -CertName "Kiwy Signage Dev" -PfxPassword "ChangeMe!1" -ExportPath "C:\certs\kiwy_dev.pfx" ================================================================================ #> [CmdletBinding()] param( [string]$CertName = 'Kiwy Signage Player (Dev)', [string]$Subject = 'CN=Kiwy Signage Player (Dev)', [string]$PfxPassword = 'KiwySignage2026!', [string]$ExportPath = (Join-Path $PSScriptRoot 'kiwy_dev_signing.pfx'), [switch]$SkipTrust ) $ErrorActionPreference = 'Stop' Set-Location $PSScriptRoot # ── 1. Create the self-signed code-signing certificate ────────────── Write-Host "[STEP] Creating self-signed code-signing certificate..." -ForegroundColor Cyan $cert = New-SelfSignedCertificate ` -Subject $Subject ` -FriendlyName $CertName ` -Type CodeSigningCert ` -CertStoreLocation 'Cert:\CurrentUser\My' ` -KeyExportPolicy Exportable ` -KeyAlgorithm RSA ` -KeyLength 2048 ` -NotAfter (Get-Date).AddYears(10) if (-not $cert) { Write-Host "[ERROR] Failed to create certificate." -ForegroundColor Red exit 1 } Write-Host "[OK ] Created cert: $($cert.Subject) thumbprint=$($cert.Thumbprint)" -ForegroundColor Green # ── 2. Export to PFX ───────────────────────────────────────────────── Write-Host "[STEP] Exporting to PFX: $ExportPath" -ForegroundColor Cyan $securePwd = ConvertTo-SecureString -String $PfxPassword -Force -AsPlainText try { Export-PfxCertificate -Cert $cert -FilePath $ExportPath -Password $securePwd -Force | Out-Null Write-Host "[OK ] PFX written: $ExportPath" -ForegroundColor Green } catch { Write-Host "[WARN ] Could not export PFX (still usable from cert store): $($_.Exception.Message)" -ForegroundColor Yellow } # ── 3. Trust it on THIS machine (Root + Trusted Publisher) ─────────── if (-not $SkipTrust) { Write-Host "[STEP] Installing to Trusted Root + Trusted Publisher (requires admin)..." -ForegroundColor Cyan try { $rootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store( 'Root', 'CurrentUser') $rootStore.Open('ReadWrite') $rootStore.Add($cert) $rootStore.Close() $pubStore = New-Object System.Security.Cryptography.X509Certificates.X509Store( 'TrustedPublisher', 'CurrentUser') $pubStore.Open('ReadWrite') $pubStore.Add($cert) $pubStore.Close() $peopleStore = New-Object System.Security.Cryptography.X509Certificates.X509Store( 'TrustedPeople', 'CurrentUser') $peopleStore.Open('ReadWrite') $peopleStore.Add($cert) $peopleStore.Close() Write-Host "[OK ] Certificate trusted on this machine." -ForegroundColor Green } catch { Write-Host "[WARN ] Trust install failed (run as Administrator): $($_.Exception.Message)" -ForegroundColor Yellow } } Write-Host "" Write-Host "================ RESULT ================" -ForegroundColor Green Write-Host "Cert : $($cert.Subject)" Write-Host "Thumb : $($cert.Thumbprint)" Write-Host "PFX : $ExportPath (password: $PfxPassword)" Write-Host "" Write-Host "To sign the exe with this cert:" Write-Host " .\sign_exe.ps1 -CertPath `"$ExportPath`" -CertPassword `"$PfxPassword`"" Write-Host "" Write-Host "REMINDER: This self-signed cert is for DEV ONLY. Production PCs" Write-Host "with Smart App Control ON need a cert from a public CA." Write-Host "========================================" -ForegroundColor Green