SignTool Error: No File Digest Algorithm Specified. Please Specify the Digest Algorithm with the /fd Flag

Diagnostic flow — find which digest is actually missing

Fix #1 — understand why an old build started failing

Microsoft documents that Windows 10 SDK/HLK/WDK/ADK builds 20236 and later require digest algorithms to be specified. Current SignTool documentation says the sign command requires /fd. Earlier behavior could produce a warning with exit code 0; later SignTool versions promote the omission to an error.

Verify: inspect the SignTool version/path used locally and in CI, then ensure every active signing path emits an explicit /fd.

Fix #2 — /fd and /td solve different digest problems

/fd SHA256 specifies the digest used for the file signature. /td SHA256 specifies the digest requested from an RFC 3161 timestamp server when you use /tr. One does not replace the other. Legacy Authenticode timestamping uses /t, which cannot be combined with /tr; do not bolt /td onto a /t command.

Verify: confirm the command now has both file and timestamp digest options in the correct roles. If the timestamp server itself is unreachable or returns an invalid response, use the dedicated timestamp-server guide.

Fix #3 — already added /fd? Inspect the command your wrapper actually runs

This is the main branch that one-line fixes miss. Cake documented a real case where its SignTool runner omitted /fd unless a digest setting produced the expected argument. Similar problems can occur in build targets, Visual Studio extensions, installer tools, custom PowerShell, or CI templates.

For MSBuild/Visual Studio failures, increase build verbosity enough to expose the signing command or inspect the target/script that invokes SignTool. For Cake or another wrapper, set the wrapper’s digest/signing option rather than appending text to a command that the wrapper never uses.

Verify: rerun the build and inspect every emitted SignTool signing invocation. The intended /fd must be present in the specific invocation that fails—not merely in a source/config file or in an earlier signing pass. This matters when a wrapper appends another signature or performs multiple signing stages.

Fix #4 — local works, CI fails after an SDK image update

Compare the SignTool executable selected by each environment. A hosted runner or updated build image may resolve a newer Windows SDK than your workstation, exposing a previously tolerated missing digest option.

If the runner uses a full versioned path, capture that path from its log as well. Fix the shared signing configuration so every ordinary signing invocation emits the intended /fd instead of pinning an old SDK solely to preserve legacy implicit behavior. If local and CI generate different numbers of signing passes, compare them invocation-by-invocation rather than only comparing the final command.

Verify: compare the actual executable/path and generated signing command on local and CI. Both should explicitly specify the intended file digest.

Fix #5 — advanced digest signing: /dg, /ds, and /di are different

If you use SignTool’s separated digest workflow, do not blindly add /fd to every phase. Microsoft Q&A documents an edge case beginning with SignTool 10.0.20348.0 where sign /di can report the missing-/fd error even though /di is incompatible with /fd. Microsoft documented /fdws as the compatibility switch for that /di scenario.

Verify: confirm whether your workflow actually generates/signs/ingests external digests with /dg, /ds, /di. If not, stay with the normal /fd branch.

Final verification — prove the artifact is signed, not just that the error disappeared

Use the verification policy appropriate to your artifact; the example above is for general Authenticode. Driver/catalog verification has different policy considerations.

Verify: confirm the expected signer/signature set and digest in verbose output. For append/dual-signing workflows, verify the resulting signatures rather than assuming the final invocation represents the whole artifact. If verification now fails with 0x800B0109—or signing progresses to certificate, timestamp, provider or another concrete error—stop diagnosing missing /fd and follow that new stage.

Still seeing the exact /fd error?

If signtool itself is not recognized, use ‘signtool’ Is Not Recognized. If the command reaches timestamping but the server fails, use Timestamp Server Could Not Be Reached or Returned an Invalid Response. If signing succeeds but verification reports 0x800B0109, use Root Certificate Not Trusted.

Official references