Error -6258. msi signing stopped working from one day to the next

[SMadden]

Hi,

Over the long Thanksgiving weekend all our builds that sign the windows installer package have stopped working. No code or system changes were made. I triple checked that the signing certificate is still valid for another 6 months and that it's not corrupt. It's the same on all build servers and my local dev machine. We use a pfx with password. The certificate was created using SHA-1, which will be deprecated, but according to the documentation it should still work if the certificate was created before Jan 1st 2016 (which it was).

I'm running out of ideas what it could be. Did anybody else run into an issue like this before? Here is the full error.

Media table successfully built
Started signing certificate.msi ...
ISDEV : error -6258: An error occurred extracting digital signature information from file "...\PROJECT_ASSISTANT\Interm\certificate.msi". Make sure the digital signature information provided in the IDE is correct.
Started signing BCU.msi ...
ISDEV : error -6258: An error occurred extracting digital signature information from file "...\BCU\PROJECT_ASSISTANT\SINGLE_EXE_IMAGE\DiskImages\DISK1\BCU.msi". Make sure the digital signature information provided in the IDE is correct.
ISDEV : error -6003: An error occurred streaming '...\PROJECT_ASSISTANT\SINGLE_EXE_IMAGE\DiskImages\DISK1\BCU.isc' into setup.exe

Any suggestions on what to try are welcome 🙂

Thanks,
Sandra

[joshstechnij]

This error essentially is indicating that the MSI package either has no digital signature, or the certificate used does not terminate in a trusted root.

Are there any other digital signing errors in your build log, or any SigningHelper messages? If no such information is present in the log, does the MSI contained in the release Disk1 folder contain a digital signature (right-click the MSI in Windows Explorer, select Properties and look for the Digital Signature tab)? If it does, what state does Windows consider the signature based on the 'Digital Signature Information' field (double-click a listed signature to view it)?

[SMadden]

interesting. The msi does have a valid signature, but the build still fails. The certifcate.msi also exists in the Interm folder and has a signature. I can also use signtool.exe in a command shell to successfully sign the packages by hand, so I think that shows that the pfx is not corrupt or expired.

ISDEV : error -6258: An error occurred extracting digital signature information from file "...\BCU\BCU\PROJECT_ASSISTANT\Interm\certificate.msi". Make sure the digital signature information provided in the IDE is correct.

Regarding the build.log. In the beginning it shows that it's successfully signing the swidtag, the build only fails in the end when it tries to sign the msi/setup.exe packages.

Created release folders
Started signing regid.2000-02.com.vocera_36DD0A12-F31B-4193-9F2F-DFA01BA916AF.swidtag ...
Note: Optional element swid:product_id is not present in swidtag
Successfully signed swidtag 'regid.2000-02.com.vocera_36DD0A12-F31B-4193-9F2F-DFA01BA916AF.swidtag'
InstallShield Script Compiler
Version 23.0.0.288
Copyright (c) 2016 Flexera Software LLC. All Rights Reserved.

[Superfreak3]

I'm having a similar problem.

6259 Error signing certificate.msi.  The file is in the Interim folder and is signed.

Is/was there a resolution to this problem?

All other files seem to sign properly.

[DClayton9]

This just started happening to me today.  The project previously built fine last week.  This is also happening with other projects.  I know it's not my pfx file or password, as I'm still able to use signtool.exe to sign my components.

This is holding up a release.

[jmallon]

Thinking it's systemic to Flexera/ Installshield.

I'm seeing the same thing. It broke today, sometime after 4PM EST.

If you still have a support license I'd ask that you open a ticket - as I am - so that we can get some eyes on this.

[Tsirikul]

I also have the same issue today and it holds up my release to the customer. Can you please help ASAP?

[jmallon]

Came here to say the same thing. 

Across projects, across machines, on different networks, all of our compiles now fail with this error. 

Started signing certificate.msi ...
ISDEV : error -6259: Internal build error
Started signing MyProj.msi ...
ISDEV : error -6258: An error occurred extracting digital signature information from file "D:\Package\CD\Build\DiskImages\DISK1\MyProj.msi". Make sure the digital signature information provided in the IDE is correct.
ISDEV : error -6003: An error occurred streaming 'D:\Package\CD\Build\DiskImages\DISK1\MyProj.isc' into setup.exe
Setup.exe created
Started signing setup.exe ...
Automatic update notification disabled

[banna_k]

Hi @Superfreak3 ,

Can you try the solution specified  in the below KB article: 
"Install root and intermediate certificates on the build machine or add them to the certificate store InstallShield is using."

https://community.flexera.com/t5/InstallShield-Knowledge-Base/Error-6259-6258-and-6003-while-attempting-to-sign-installers/ta-p/4023

[harryclipper]

Hi,

I got the same today.

Yesterday it worked without Problems.

Each year in the past I had to reactivate my product. Not this year, so i tried this, but still the same Errors (6259, 6258, 6003)

My Certificate is still valid.

Can someone help me?

thank you

Harald

[ldl_omada_dk]

Hello,

Looks like it's quite a popular issue today. Same problem in my case - no changes to the server, certificates and code since yesterday, but it stopped working...

[ldl_omada_dk]

Found a solution (at least for my issue):

When I try to create installer using InstallShield 2018 it fails with the error mentioned in this thread.

When I try to create installer using InstallShield 2020 works like charm. Same code, same project, same server, same certificates...

Not cool Flexera.

Happy new years to the rest of you.

[ThomasSiever]

Hello,

same with our project. We are using IS Lite 2019 and there was not problem a few days ago. Same project, nothing has changed. Other exe files are still signed correctly.

Any ideas for a workaround are welcome.

Thanks

Thomas

[rbaiwar]

Facing same issue. Was working yesterday and its not working today all of a sudden. Nothing seems to have changed.

[Tsirikul]

RESOLVED!!! ERROR Error 6259, 6258, and 6003 Please try the following steps

1. Close the InstallShield IDE.
2. Open File Explorer
3. Navigate to the following file:

C:\Program Files (x86)\InstallShield\20xx\Support\0409\Settings.xml

1. Make a backup copy of Settings.xml.
2. Change the following lines from: 

   From : <DigitalSignature Timestamp="http://timestamp.verisign.com/scripts/timstamp.dll"/>

   To  <DigitalSignature Timestamp="http://timestamp.digicert.com/scripts/timstamp.dll"/>

3. Save Changes
4. Copy and Paste it in C:\Program Files (x86)\InstallShield\20xx\Support\0409\Settings.xml

Good Luck to all,

Tom Sirikul

[Superfreak3]

Just an FYI, the changes I mentioned above match the out-of-the-box Settings.xml content for timestamping in InstallShield 2020.  Though it works as you stated, there appears to be no need for the URL to point to the scripts/timestamp.dll.

[banna_k]

Hi All,

Please install the digital signing patch if you are configured to sign using Digicert server and using older version of InstallShield:

More information on this patch can be found at the below link: 

https://community.flexera.com/t5/InstallShield-Knowledge-Base/Digital-Signing-Patch-for-InstallShield-2015-SP2-and-above/ta-p/121641

[vinodInstall]

Is this problem resolved?
Please give me solution if you got solution

[rbaiwar]

Please try the following steps

1. Close the InstallShield IDE.
2. Open File Explorer
3. Navigate to the following file:

C:\Program Files (x86)\InstallShield\20xx\Support\0409\Settings.xml

1. Make a backup copy of Settings.xml.
2. Change the following lines from: 

   From : <DigitalSignature Timestamp="http://timestamp.verisign.com/scripts/timstamp.dll"/>

   To  <DigitalSignature Timestamp="http://timestamp.digicert.com/scripts/timstamp.dll"/>

3. Save Changes
4. Copy and Paste it in C:\Program Files (x86)\InstallShield\20xx\Support\0409\Settings.xml

[m_schmeller]

The same errors occur with us. We use Installshield 2014.
The builds yesterday were signed without any problems.
We haven't changed anything since yesterday!
Who can help?

[ThomasSiever]

Hello.

not sure if this helps. We have the this problem and our certificate is issued by: Sectigo RSA Code Signing CA

Do you face the this problem with Sectigo too or is the certificate issued by another publisher?

Thomas