使用自签名代码证书时signtool.exe运行缓慢的原因及时间戳使用疑问咨询

Hey there, let's work through your issues step by step—first that painfully slow signing process, then the timestamp question for self-signed certs.

Why Your DLL Signing Is Taking 5-10 Minutes #

That delay is almost certainly tied to timestamp server communication, since signing a small DLL itself should take seconds, not minutes. Here are the fixes to try:

• Swap to a more reliable timestamp server: Even if you tested a list of servers, some might be geographically distant, throttled, or temporarily unstable. Stick to well-maintained, widely used options like:
  • http://timestamp.digicert.com
  • http://timestamp.sectigo.com
  • http://timestamp.microsoft.com
    Try updating your signtool command to use one of these—for example:

  signtool sign /f YourSelfSignedCert.pfx /p YourCertPassword /tr http://timestamp.digicert.com /td SHA256 YourSmallDLL.dll
  

  Using /tr (RFC 3161 timestamp) instead of the older /t flag can also improve reliability and speed for modern systems.
• Check network restrictions: Firewalls, corporate proxies, or VPNs might be blocking or throttling outgoing requests to timestamp servers. Test signing from a network without these restrictions (like a home network) to rule this out. If you're on a corporate network, ask your IT team to whitelist the timestamp server domains.
• Verify your certificate's algorithm: Make sure your self-signed cert uses SHA256 (or newer) instead of outdated SHA1. SHA1 is slower and less secure, and some timestamp servers may prioritize requests for newer algorithms.

Do Self-Signed Certificates Need Timestamps? #

Great question—here's the breakdown:

• They're not required, but they're highly recommended.
  • Without a timestamp: When your self-signed cert expires (even if it's years from now), Windows will mark the DLL's signature as invalid. You'll have to re-sign every file with a new cert once the old one expires.
  • With a timestamp: The timestamp proves you signed the DLL at a time when your cert was still valid. Even after the cert expires, the signature will remain valid because the system checks the timestamped signing time instead of the current time.
• For internal/testing use cases: If your cert has an extremely long expiration (e.g., 10+ years) and you only use the DLL in a closed environment, you might get away without a timestamp. But it's still a good practice to include it—you never know when you'll need to reuse the DLL later after the cert expires.

内容的提问来源于stack exchange，提问作者luken