Introduction

#1: Reproduce the Symptom

1. Attempt to build an installer using InstallAnywhere with a code-signing certificate stored only in an HSM or Azure Key Vault that does not expose a .pfx or a certificate with an accessible private key in the Windows certificate store.
2. Observe that installer creation fails due to inability to sign launcher/uninstaller files or that the build reports missing .pfx/private key support.

#2: Diagnose the Cause

1. Confirm that InstallAnywhere requires either a .pfx file or a certificate available in the system certificate store that exposes a private key for signing during the build process.
2. Verify that the HSM/Azure Key Vault configuration does not provide a .pfx export or a certificate store entry with an accessible private key for the build environment.

#3: Apply a Temporary Workaround to Complete the Build

1. Pre-sign launcher and uninstaller executable files outside of the InstallAnywhere build process using the HSM/Azure Key Vault signing mechanism you have available.
2. Configure the InstallAnywhere project to build without signing. Ensure the pre-signed launcher and uninstaller files are used by the build so their signatures are preserved.
3. In the InstallAnywhere project settings, disable the option "Apply Uninstaller/Launcher File Attributes" to prevent InstallAnywhere from altering or invalidating the pre-applied signatures.

#4: Apply the Long-Term Resolution

1. Migrate to a product release that supports custom signing integration if available. A later release added custom signing support that removes the need for a .pfx or direct certificate store private key during the build.
2. If migration is not immediately possible, continue using the pre-sign-and-build-without-signing workflow until an upgrade can be planned and applied.

#5: Validation and Follow-Up

1. After applying the workaround or upgrading, rebuild the installer and verify that launcher and uninstaller files remain signed and that the installer completes successfully.
2. If build errors persist, recheck that pre-signed files are being packaged and that "Apply Uninstaller/Launcher File Attributes" remains disabled.

After following these steps, the installer build will complete while preserving valid signatures on launcher and uninstaller files. Upgrading to a release with custom signing support eliminates the need for a .pfx or an exportable private key during the build process. Reopen or file a new support request if further assistance is needed.