Code signing certificate installed but build agent cannot use it

Scenario

The certificate is present on the server, but automated builds fail when attempting to sign executables or scripts.

Confirm the build agent account has access to the private key.
Check whether the certificate lives in the correct store and includes the needed EKU.
Test signing interactively under the same service account context where possible.
Document key access requirements so signing survives future agent rebuilds.

Document what changed, what confirmed the fix, and whether the issue points to a broader standards gap worth addressing for the client.

Subjects