Windows / Win32 / How to troubleshoot app package signature errors

How to troubleshoot app package signature errors

An app deployment failure can be caused by a failure to validate the digital signature of the app package. Learn how to recognize these failures, and what to do about them.

When you deploy a packaged Windows app, Windows always attempts to validate the digital signature on the app package. Failures during signature validation block deployment of the package. But why the package didn't validate might not be obvious. In particular, if you sign your packages with private certificates for local testing, you often must manage the trust for those certificates as well. An incorrect certificate trust configuration can lead to signature validation failures.

What you need to know

Technologies

Prerequisites

Instructions

Step 1: Examine event logs for diagnostic information

Depending on how you attempted to deploy your app, you might not have received a meaningful error code for the deployment failure. In this case, you can usually get the error code directly from the event logs.

To get the error code from the event logs

  1. Run eventvwr.msc.
  2. Go to Event Viewer (Local) > Applications and Services Logs > Microsoft > Windows.
  3. The first log to check is AppxPackagingOM > Microsoft-Windows-AppxPackaging/Operational.

  4. Deployment-related errors are recorded in AppXDeployment-Server > Microsoft-Windows-AppXDeploymentServer/Operational.

    For deployment errors, search for the most recent error event 404. This error event provides you with the error code and a description of why the deployment failed. If an error event 465 preceded the 404 event, there was a problem opening the package.

If the 465 error didn't occur, see general Troubleshooting packaging, deployment, and query of Windows apps. Otherwise, refer to this table for common error codes that can show up in the error string for error event 465:

SymbolicCodeDescription
ERROR_INSTALL_OPEN_PACKAGE_FAILED0x80073CF0The app package could not be opened.
APPX_E_INVALID_BLOCKMAP0x80080205The app package has been tampered with or has an invalid block map.
TRUST_E_SUBJECT_NOT_TRUSTED0x800B0004The app package has been tampered with.
TRUST_E_NOSIGNATURE0x800B0100The app package is unsigned.
CERT_E_UNTRUSTED_ROOT0x800B0109The certificate chain that was used to sign the app package ends in a root certificate that isn't trusted.
CERT_E_CHAINING0x800B010ANo certificate chain could be built to a trusted root authority from the cert that was used to sign the app package.
6 entries

Article text from the Win32 documentation, by Microsoft, under the CC BY 4.0 licence.