Certification errors

The app manifest publisher name must match the subject name of the signing certificate

SignTool fails with "SignerSign() failed." (-2147024885 / 0x8007000B). The detail is in Event Viewer, event ID 150: "The app manifest publisher name (CN=Contoso) must match the subject name of the signing certificate (CN=Contoso, C=US)."

What it means

The

Publisher
attribute of the
Identity
element in your manifest must be exactly the same as the Subject of the certificate you sign with, every part included. In Microsoft's example, CN=Contoso doesn't match CN=Contoso, C=US.

For the Microsoft Store you don't need to sign at all. Microsoft signs MSIX packages after they pass certification and replaces any signature you added. You only need this for packages you install yourself or ship outside the Store.

How to fix it

  1. Confirm the cause in Event Viewer under Applications and Services Logs, Microsoft, Windows, AppxPackagingOM, Microsoft-Windows-AppxPackaging/Operational. Event 151 means the /fd hash algorithm doesn't match the package block map, so use SHA256. Event 152 means the package is corrupt and needs to be rebuilt.
  2. For event 150, copy the Publisher value from your manifest and make a certificate with exactly that subject. For a test certificate:
    New-SelfSignedCertificate -Type Custom -KeyUsage DigitalSignature -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3", "2.5.29.19={text}") -Subject "CN=Contoso Software, O=Contoso Corporation, C=US" -FriendlyName "Your friendly name goes here"
  3. If you use a certificate you bought, change the manifest's Publisher to the certificate's subject instead. For a Store build, keep the Publisher Partner Center gave you.
  4. Sign again.

Sending the fixed update with StoreFast

StoreFast can send your next update to Partner Center from a dashboard, CI or a coding agent.

Sources

Facts about Microsoft's tools were checked against these pages on October 16, 2026.