Artifact signing stopped working

Question

Artifact signing stopped working

Prakash 0

Hi,

We are using trusted/artifact signing for past 2 years it worked without issues. But for the last few days we are getting the below error,

Submitting digest for signing...
Unhandled managed exception
Azure.RequestFailedException: Service request failed.
Status: 403 (Forbidden)

Headers:
Date: Tue, 14 Apr 2026 04:09:45 GMT
Connection: keep-alive
Server: Kestrel
Strict-Transport-Security: REDACTED
Content-Length: 0

   at Azure.CodeSigning.CertificateProfileRestClient.SignAsync(String codeSigningAccountName, String certificateProfileName, SignRequest body, String xCorrelationId, String clientVersion, CancellationToken cancellationToken)
   at Azure.CodeSigning.CertificateProfileClient.StartSignAsync(String codeSigningAccountName, String certificateProfileName, SignRequest body, String xCorrelationId, String clientVersion, CancellationToken cancellationToken)
   at Azure.CodeSigning.Dlib.Core.DigestSigner.SignAsync(UInt32 algorithm, Byte[] digest, SafeFileHandle safeFileHandle, CancellationToken cancellationToken)
   at Azure.CodeSigning.Dlib.Core.DigestSigner.Sign(UInt32 algorithm, Byte[] digest, SafeFileHandle safeFileHandle)
   at AuthenticodeDigestSignExWithFileHandleManaged(_CRYPTOAPI_BLOB* pMetadataBlob, UInt32 digestAlgId, Byte* pbToBeSignedDigest, UInt32 cbToBeSignedDigest, Void* hFile, _CRYPTOAPI_BLOB* pSignedDigest, _CERT_CONTEXT** ppSignerCert, Void* hCertChainStore)

SignTool Error: An unexpected internal error has occurred.
Error information: "Error: SignerSign() failed." (-2147467259/0x80004005)

Below is the screen shot of the certificate profile it is still active but the date seems expired. Not sure why it is not automatically renews. Is there any reason for that?

enter image description here [Updated]

The artifact signing certificate profile account was created almost 1.5 years back. The country is India.

Saw a warning message in the azure portal that "Artifact Signing is currently available to organizations in the USA, Canada, European Union & United Kingdom.". Seems that was there for the last one year.

Is it suddenly enforced for the existing accounts as well? thats why the auto renewal of public trust profiles are blocked? It will be great to have a concrete answer from the Microsoft side so that we can move and look for other alternates.

Note: I also have a certificate profile of type "Public Trust Test" where it certificate is not expired and it is working as expected but it is a test certificate. This indicates there are no permission or endpoint url issues.

0 comments

3 answers

Your answer

Answer 1

Prakash 0

Got an update from azure! They confirmed it was one time issue and fixed the renewal. Also they confirmed that the geo restriction is not applicable to the existing customers.

Mehul Sethia 0 Reputation points

2026-07-22T17:01:42.87+00:00

Hey bro, i was exploring this route, hit a wall w the artifict account thingy blocked in india. Any idea if there's a workaround for this? How did you raise a ticket to microsoft? Im on the free/basic plan, cant find a way to reach out to them.

Answer 2

The artifact signing certificate profile account was created almost 1.5 years back. The country is India.

Saw a warning message in the azure portal that "Artifact Signing is currently available to organizations in the USA, Canada, European Union & United Kingdom.". Seems that was there for the last one year.

Is it suddenly enforced for the existing accounts as well? thats why the auto renewal of public trust profiles are blocked? It will be great to have a concrete answer from the Microsoft side so that we can move and look for other alternates.

Note:
I also have a certificate profile of type "Public Trust Test" where it certificate is not expired and it is working as expected but it is a test certificate. This indicates there are no permission or endpoint url issues.

Answer 3

The 403 (Forbidden) with SignerSign() failed indicates that Artifact Signing is rejecting the sign request, not that SignTool itself is broken. In the context of Artifact Signing, common 403 causes are:

Subscription or account not in a valid state
Identity no longer having the Artifact Signing Certificate Profile Signer role
Endpoint / profile metadata mismatch
Certificate profile not in an active/valid state from the service’s perspective

For Artifact Signing specifically, the documented mitigations for 403 are:

Verify the Azure subscription status is Registered.
Confirm that the identity used to sign (user, service principal, or managed identity) still has the Artifact Signing Certificate Profile Signer role on the resource group or subscription that contains the Artifact Signing account.
Check that the CodeSigningAccountName and CertificateProfileName in the metadata.json file exactly match the Artifact Signing account and certificate profile names.
Ensure the dlib path and dlib version are correct and supported, and that the recommended Windows SDK and .NET versions are installed.
Confirm that the certificate profile’s Status is Active and that the identity validation for that profile shows Completed.
Verify that the Endpoint in metadata.json matches the region where the Artifact Signing account and certificate profile were created. A region/endpoint mismatch commonly produces 403 and an internal SignerSign() failure.
If using Private Trust, ensure the same user object ID that calls Get-AzCodeSigningRootCert is the one doing the signing and that it has the Artifact Signing Certificate Profile Signer role.
Try the signing operation from a different VM or machine to rule out local or network issues reaching the Artifact Signing endpoint.

Regarding the expiry date shown in the portal: Artifact Signing certificates themselves are short-lived (three-day validity) and are managed by the service; time stamping is required so signatures remain valid beyond that period. The service documentation does not describe automatic renewal behavior for the certificate profile’s portal “Expiry date” field, and it does not expose the underlying Authenticode certificate to the customer. If the profile shows an expiry date in the past while the status is still Active but signing returns 403, this aligns with the general guidance that the profile or its validation/state in the service must be checked and, if necessary, recreated.

Because Artifact Signing resources cannot be migrated across subscriptions or tenants and must be recreated when those change, if there has been any change to subscription or tenant, all Artifact Signing resources (including certificate profiles) must be recreated.

Actionable steps:

In Azure portal, open the subscription that contains the Artifact Signing account and confirm the subscription is Registered.
On the Artifact Signing account and certificate profile:
- Confirm Status is Active.
- Confirm identity validation status is Completed.
In Access control (IAM) for the resource group or subscription, verify that the signing identity has the Artifact Signing Certificate Profile Signer role.
Open the metadata.json used by SignTool and verify:
- Endpoint matches the region of the Artifact Signing account.
- CodeSigningAccountName and CertificateProfileName exactly match the portal values.
Ensure the latest Azure.CodeSigning.Dlib.dll, Windows SDK, .NET runtime, and C++ Redistributables are installed as required.
If all of the above are correct and the profile still shows a past expiry date with 403 responses, create a new certificate profile in the same Artifact Signing account, update metadata.json to point to the new profile, and test signing again.

References: