Create and Set Up a Self-Signed Code-Signing Certificate on Endpoint v2.x

This deprecated task generates and configures a self-signed RSA 4096-bit SHA256 code-signing certificate on the endpoint for use with Windows Defender Application Control (WDAC). The task creates required BAC directories, stores the certificate in the Cert:\LocalMachine\My store, and exports the public certificate to BAC\Certs\WDAC_SigningCert.cer for use in WDAC policy signing and deployment workflows.

About this task

Important:
This task is deprecated and will be removed from BigFix Application Control v2.x in a future release. Use Provision the TPM-Enforced WDAC Policy Signing Certificate on the WDAC Management Node instead.
Use this task to generate and configure a self-signed code-signing certificate on the endpoint for use with Windows Defender Application Control (WDAC).
The task performs the following:
  • Creates the following required BAC directories if they do not exist:
    • BAC\Certs
    • BAC\Logs
  • Generates a self-signed code-signing certificate with:
    • RSA 4096-bit key
    • SHA256 hashing
    • Digital Signature usage
    • Validity based on user input
  • Stores the certificate at the Cert:\LocalMachine\My location.
  • Exports the public certificate to the BAC\Certs\WDAC_SigningCert.cer folder.
  • Logs errors (if any) to the BAC\Logs\Create_WDAC_SigningCert.log location.
Refer to the table below to know more about the task's exit code.
Table 1. Create Self-Signed Certificate on Endpoint v2.0: Task Exit Codes and Meanings
Exit Code Meaning
0 Success
10 BAC directory creation failure
11 Certificate directory creation failure
12 Log directory creation failure
20 Certificate creation failure
30 Certificate export failure
Figure 1. BigFix Console — Create and Set Up Self-Signed Certificate on Endpoint v2.0 Task Overview

BigFix Console showing the Setup and Create Self-Signed Certificate on Endpoint v2.0 task in the Fixlets and Tasks pane, displaying the task description including the BAC directory creation steps, RSA 4096-bit SHA256 certificate generation process, LocalMachine certificate store location, and WDAC_SigningCert.cer export path for use in WDAC policy signing workflows.

Procedure

  1. In the BigFix Console, navigate to All Content > BigFix Application Control > Fixlets and Tasks.
  2. From the Fixlets and Tasks pane, select Task: Setup and Create Self-Signed Certificate on Endpoint v2.0.
  3. From the Task: Setup and Create Self-Signed Certificate on Endpoint v2.0 pane, under Configuration Options, enter the following information:
    Figure 2. BigFix Console — Setup and Create Self-Signed Certificate on Endpoint v2.0: Configuration Options Panel

    BigFix Console showing the Configuration Options panel for the Setup and Create Self-Signed Certificate on Endpoint v2.0 task, with the Certificate Validity (Years) input field where the administrator specifies the number of years for which the newly generated RSA 4096-bit SHA256 self-signed code-signing certificate will remain valid.
    Table 2. Setup and Create Self-Signed Certificate on Endpoint v2.0: Configuration Options Parameter Descriptions
    Field Name Description
    Certificate Validity (Years) Number of years for which the newly generated certificate will be valid.
  4. From the Task: Setup and Create Self-Signed Certificate on Endpoint v2.0 pane, click the Applicable Computers(n) tab and view the endpoints on which you want to run the task.
  5. Select the Take Actions tab and select the endpoints on which you want to apply this installer task.
  6. Click OK.

Results

A successful execution of this task results in the following outcomes:
  • A self-signed WDAC certificate is created on the endpoint.
  • The certificate is available in the LocalMachine store.
  • The public certificate is exported to the BAC folder.
  • A certificate is ready for WDAC policy signing and deployment.