The verify command checks the validity of signed files, ensuring their integrity and confirming that the signatures are trusted. It can verify multiple files efficiently with wildcard support.
SignotaurTool.exe verify [options] [files]
A list of file paths to verify. You can specify individual file paths or use wildcards to match multiple files. This parameter supports the following wildcard patterns:
*: Matches zero or more characters within a file name. For example, *.exe will match all executable files in the specified directory.?: Matches a single character. For instance, file?.dll will match file1.dll, file2.dll, but not file12.dll.**: Indicates a recursive search across all subdirectories. For example, **/*.exe will match all .exe files found in the current directory and all its subdirectories.!: Identifies an exclude pattern. This must be at the start of the pattern. It must be used in conjunction with a normal include pattern. For instance, the two patterns *.dll and !*.Test.dll will match all .dll files found in the current directory excluded all test dlls, that is file1.dll, file2.dll, but not file1.Test.dll.Examples:
*.exe: Matches all executable files in the specified directory.C:\Projects\**\*.dll: Matches all dynamic link library files in the C:\Projects directory and any of its subdirectories.C:\MyFiles\file?.exe: Matches any executable files that start with "file" followed by a single character.!*.pdb: Matches all debug files in the specified directory from the current match.Notes:
--file-list option to specify the path to a file containing the list of file paths.When verifying ClickOnce (.application) or VSTO (.vsto) files, you can specify which dependency files should be verified using content patterns. Use a colon (:) to separate the root file pattern from the content patterns. See ClickOnce and VSTO Verification.
--fl, --file-list <FileName>
Specifies the path to a file containing a list of file paths to verify. Each line in the file should contain one file path. The tool will interpret each path just as it does for the Files parameter. For ClickOnce/VSTO files, you can use the content pattern syntax (:) to filter dependencies (e.g., MyApp.application:*.dll:*.exe).
-b, --base-directory <Directory>
Sets the base directory for resolving relative file paths.
--ir, --ignore-untrusted-root
Ignores untrusted root errors when verifying a file signed with a self-signed certificate. Use this option with caution as it bypasses trust validation for the root certificate.
-m, --max-degree-of-parallelism <MDOP>
Specifies the maximum number of concurrent file verification operations. Default is 4. A higher value can speed up processing for large file sets.
--cf, --continue-on-fail
Continues verifying subsequent files even if an error occurs while verifying a file. This option is useful for batch verification scenarios.
--encoding <Encoding>
Specifies the output encoding. Set to one of UTF8, UTF16, OEMCodePage or CodePage### where ### is the number of the code page to use. Defaults to UTF8.
--theme <Theme>
Specifies the console colour theme. Options are: General (default, suitable for most consoles), Dark (optimized for dark backgrounds), Light (optimized for light backgrounds), or None (disables colours). The default is General.
--nc, --no-colour, --no-color
Disables coloured output entirely. This is useful for CI/CD environments, log files, or systems that don't support ANSI colour codes. Alternatively, you can set the NO_COLOR environment variable to any non-empty value to achieve the same effect (following the no-color.org standard).
`--nb
Hides the banner in the output, which may be useful for scripting or logging purposes where you want a clean output.
-v, --verbose
Enables verbose logging for the verification process, providing detailed output, which can be useful for debugging.
--rm, --revocation-mode <Mode>
Specify the revocation check mode when verifying the certificate chain. By default, the verification process may try to check the certificate status against online Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP) responders. If these URLs are inaccessible or slow to respond — possibly due to firewall restrictions, then changing the revocation mode can improve verification performance. The parameter accepts the following <Mode> values:
--sl|--strict-lifetime
Strictly enforce signature validity to the certificate’s validity period when a timestamp is present.
--uf, --unsupported-file-types <Action>
Controls what happens when a file type is not recognised during verification. Known file types (Authenticode, CMS, NuGet, VSIX, ClickOnce, RDP) are always verified with the correct method automatically.
Verify files with default settings:
SignotaurTool.exe verify file1.exe file2.dll
Verify files with a file list:
SignotaurTool.exe verify --fl filelist.txt
Verify a CMS-signed .mobileconfig profile (automatically detected):
SignotaurTool.exe verify profile.mobileconfig
Verify a signed NuGet package (automatically detected):
SignotaurTool.exe verify MyPackage.1.0.0.nupkg
Verify a signed Visual Studio extension (automatically detected):
SignotaurTool.exe verify MyExtension.vsix
Verify a signed Remote Desktop connection file (automatically detected):
SignotaurTool.exe verify connection.rdp
Verify a CMS-signed file with a non-standard extension:
SignotaurTool.exe verify --uf UseCMSSigning config.xml
Verify a CMS-signed file with a self-signed certificate:
SignotaurTool.exe verify --ignore-untrusted-root profile.mobileconfig
The verify command supports Authenticode verification of the following file types: .appx, .appxbundle, .cab, .cat, .cdxml, .dll, .eappx, .eappxbundle, .emsix, .emsixbundle, .exe, .msi, .msix, .msixbundle, .msm, .msp, .mst, .ocx, .ps1, .ps1xml, .psd1, .psm1, .stl, .sys, .vbs, .vxd, .winmd. Additional PE file types may also be verified automatically.
The following file types are automatically verified using CMS/PKCS#7: .mobileconfig (Apple configuration profiles), .mobileprovision (Apple/iOS provisioning profiles), .provisionprofile (macOS provisioning profiles).
Unrecognised CMS-signed files can be verified by specifying --uf UseCMSSigning.
NuGet packages (.nupkg) are automatically verified using NuGet-specific signature verification. This checks the CMS signature integrity, package hash, signing certificate, timestamp, and certificate chain.
VSIX packages (.vsix) are automatically verified using OPC XML digital signature verification. This validates the package signature, per-part digests, signing certificate, timestamp (if present), and certificate chain.
.rdp files signed by Signotaur or by Microsoft's rdpsign.exe are automatically verified. The verifier strips Microsoft's 12-byte header, decodes the embedded CMS signature, recomputes the canonical scope bytes from the file's current content, and checks the CMS signature, certificate chain, and (optional) timestamp. Tampering with any of the fields listed in signscope:s: causes verification to fail with BadDigest. See RDP file signing for more detail.
See ClickOnce and VSTO Signing for detailed information about content filtering and application-specific options.
If the input includes a .application file (ClickOnce deployment manifest), or a .vsto file (Visual Studio Tools for Office add-in manifest), the verify command automatically detects and verifies all related application files and manifests. See ClickOnce and VSTO Signing.
The following exit codes indicate the result of the operation performed by SignotaurTool.exe verify. The most common failures are 16 NoSignature (the file is unsigned), 20 UntrustedRoot (chain not anchored to a trusted root — suppress with --ignore-untrusted-root), 48 BadDigest (the signature does not match the file contents), and 21 CertificateExpired / 23 CertificateRevoked. Codes 16–58 reach the verify command via the Windows WinVerifyTrust API for Authenticode files (.exe, .dll, .msi, .cat, etc.) and via the managed verifiers for CMS, NuGet, VSIX, and RDP files; any HRESULT the Windows API can return is mappable here.
--file-list file.--ignore-untrusted-root.Typically a more specific message will be displayed before an error exit code is returned.