dotnet-nuget-sign(1)

dotnet-nuget-sign 💖

okay bestie, quick vibe check before we dive in: this whole page is for .NET 6 SDK and later versions ✔️ (so if you're on something ancient, this is not your moment, sorry 💀). This is the manual page for the dotnet-nuget-sign command, and I'm gonna walk you through it like we're texting at 2am. 🫶

---

✨ NAME ✨

dotnet-nuget-sign — signs all the NuGet packages matching the first argument with a certificate. 💅

---

🌸 SYNOPSIS 🌸

dotnet nuget sign [<package-path(s)>]
    [--certificate-path <PATH>]
    [--certificate-store-name <STORENAME>]
    [--certificate-store-location <STORELOCATION>]
    [--certificate-subject-name <SUBJECTNAME>]
    [--certificate-fingerprint <FINGERPRINT>]
    [--certificate-password <PASSWORD>]
    [--hash-algorithm <HASHALGORITHM>]
    [-o|--output <OUTPUT DIRECTORY>]
    [--overwrite]
    [--timestamp-hash-algorithm <HASHALGORITHM>]
    [--timestamper <TIMESTAMPINGSERVER>]
    [-v|--verbosity <LEVEL>]

dotnet nuget sign -h|--help

---

🦋 DESCRIPTION 🦋

So the dotnet nuget sign command signs all the packages matching the first argument with a certificate. That certificate — the one with the private key — can come from a file, or from a certificate that's already installed in a certificate store, which you point at with either a subject name or a SHA-1 fingerprint. 🔑

Heads up bestie, this command requires a certificate root store that's valid for both code signing and timestamping. Also, this command might not be supported on some combinations of operating system and .NET SDK. For more information, see NuGet signed package verification.

---

🎀 ARGUMENTS 🎀

• package-path(s) — the file path to the package(s) you want signed. You can pass in multiple arguments to sign multiple packages at once. Slay. ✨

---

💅 OPTIONS 💅

• --certificate-path <PATH> — the file path to the certificate used for signing the package.

Real talk: this option currently supports only PKCS12 (PFX) files that contain the certificate's private key. So don't come at it with anything else, it's not the vibe.

• --certificate-store-name <STORENAME> — the name of the X.509 certificate store to search for the certificate. Defaults to "My", the X.509 certificate store for personal certificates. You should use this option when you're specifying the certificate via --certificate-subject-name or --certificate-fingerprint. 🗂️
• --certificate-store-location <STORELOCATION> — the name of the X.509 certificate store used to search for the certificate. Defaults to "CurrentUser", the X.509 certificate store used by the current user. Use this one when specifying the certificate via --certificate-subject-name or --certificate-fingerprint. 🏠
• --certificate-subject-name <SUBJECTNAME> — the subject name of the certificate, used to search a local certificate store for it. The search is a case-insensitive string comparison using the value you supply, and it finds all certificates whose subject name contains that string — regardless of the other subject values. You can point at the store with --certificate-store-name and --certificate-store-location.

okay so this option currently supports only a single matching certificate in the result. If there are multiple matching certificates, or literally none, the sign command will fail. no pressure lol 😭

• --certificate-fingerprint <FINGERPRINT> — the fingerprint of the certificate, used to search a local certificate store for it.

Starting with .NET 9, this option can be used to specify the SHA-1, SHA-256, SHA-384, or SHA-512 fingerprint of the certificate. However, a NU3043 warning is raised when a SHA-1 certificate fingerprint is used, because it's no longer considered secure. In .NET 10 and later versions, that warning is elevated to an error. Only SHA-2 family fingerprints (SHA-256, SHA-384, and SHA-512) are supported.

All pre-.NET 9 versions of the .NET SDK continue to accept only SHA-1 certificate fingerprint. periodt. 💀

• --certificate-password <PASSWORD> — the certificate password, if it needs one. If a certificate is password protected but you don't hand over a password, the sign command will fail.

The sign command only supports non-interactive mode. There won't be any prompt for a password at run time. so put it in the command, bestie, it's not gonna ask nicely. 🙈

• --hash-algorithm <HASHALGORITHM> — the hash algorithm used to sign the package. Defaults to SHA256. Possible values are SHA256, SHA384, and SHA512. 🔐
• -o|--output — the directory where the signed package should be saved. If this option isn't specified, then by default the original package is overwritten by the signed package. 💾
• --overwrite — indicates that the current signature should be overwritten. By default the command will fail if the package already has a signature.
• --timestamp-hash-algorithm <HASHALGORITHM> — the hash algorithm used by the RFC 3161 timestamp server. Defaults to SHA256. ⏱️
• --timestamper <TIMESTAMPINGSERVER> — URL to an RFC 3161 timestamping server. 🌐
• -v|--verbosity <LEVEL> — sets the verbosity level of the command. Allowed values are q[uiet], m[inimal], n[ormal], d[etailed], and diag[nostic]. The default is minimal. For more information, see <xref:Microsoft.Build.Framework.LoggerVerbosity>. 📢
• -?|-h|--help — prints out a description of how to use the command. the classic "help me please" button, we love her. 🫶

---

⭐ EXAMPLES ⭐

1. Sign foo.nupkg with certificate cert.pfx (not password protected):

dotnet nuget sign foo.nupkg --certificate-path cert.pfx

2. Sign foo.nupkg with certificate cert.pfx (password protected):

dotnet nuget sign foo.nupkg --certificate-path cert.pfx --certificate-password password

3. Sign foo.nupkg with a certificate (password protected) that matches the specified SHA-256 fingerprint in the default certificate store (CurrentUser):

dotnet nuget sign foo.nupkg --certificate-fingerprint B2C40F2F8775D7B7EBEB76BD5A9D3A4BC3F4B8A4D8D7C5F8A4C6B3E7A9E2D5F1 --certificate-password password

4. Sign foo.nupkg with a certificate (password protected) that matches the specified subject name "Test certificate for testing signing" in the default certificate store (CurrentUser):

dotnet nuget sign foo.nupkg --certificate-subject-name "Test certificate for testing signing" --certificate-password password

5. Sign foo.nupkg with a certificate (password protected) that matches the specified SHA-256 fingerprint in the certificate store CurrentUser:

dotnet nuget sign foo.nupkg --certificate-fingerprint B2C40F2F8775D7B7EBEB76BD5A9D3A4BC3F4B8A4D8D7C5F8A4C6B3E7A9E2D5F1 --certificate-password password --certificate-store-location CurrentUser --certificate-store-name Root

6. Sign multiple NuGet packages — foo.nupkg and all .nupkg files in the directory specified — with certificate cert.pfx (not password protected):

dotnet nuget sign foo.nupkg c:\mydir\*.nupkg --certificate-path cert.pfx

7. Sign foo.nupkg with certificate cert.pfx (password protected), and timestamp with http://timestamp.test:

dotnet nuget sign foo.nupkg --certificate-path cert.pfx --certificate-password password --timestamper http://timestamp.test

8. Sign foo.nupkg with certificate cert.pfx (not password protected) and save the signed package under a specified directory:

dotnet nuget sign foo.nupkg --certificate-path cert.pfx --output c:\signed\

9. Sign foo.nupkg with certificate cert.pfx (not password protected) and overwrite the current signature if the package is already signed:

dotnet nuget sign foo.nupkg --certificate-path cert.pfx --overwrite

---

and that's the whole page, bestie!! 🎀 you just read the dotnet-nuget-sign(1) manual, dated 2025-08-29, straight from the .NET docs. go sign something iconic. 💜✨