Package Family Name changed with new code signing cert

The Package Family Name (PFN) suffix (in your case hs446qhh7vdt4) is a hash of the certificate's subject (AKA subject name):

certutil -dump foo.pfxEnter PFX password:================ Certificate 0 ================================ Begin Nesting Level 1 ================Element 0:Serial Number: xxxxxxxxxxxxxxxxxIssuer: CN=Microsoft, O=Contoso, L=Redmond, S=Washington, C=US NotBefore: 11/1/2016 12:00 AM NotAfter: 11/1/2017 12:00 AMSubject: CN=Microsoft, O=Contoso, L=Redmond, S=Washington, C=US <== THIS IS HASHED

If you make sure the new cert you generate has the same subject, you'll get the same PFN. Note that you might not be able to generate store certs from within Visual Studio (at the time of writing, it can't parse complex subjects like the one above with multiple 'parts' like CN=X, O=Y). In that case you'll have to create your own, but it must comply with the store validations.

Luckily, there's a simple command that generates the exact certificate you need. Open a Visual Studio developer prompt and run (one line):

makecert -sv foo.pvk -n "CN=Contoso, O=Contoso, L=Redmond, S=Washington, C=US"     foo.cer -b 11/01/2016 -e 11/01/2017 -r -cy end -a sha256 -eku 1.3.6.1.5.5.7.3.3

Make sure to replace the validity dates (no more than a year apart!) as well as the subject (taken from your previous cert using certutil -dump). The names of the output cert (cer) and private key (pvk) are meaningless. That command will generate foo.pvk and foo.cer, which you will then be able to combine to a pfx like so:

PVK2PFX -pvk foo.pvk -spc foo.cer -pfx foo.pfx

Another option for advanced generation

In case you have more advanced cert requirements, you should be able to use certreq (haven't tested it though). Create a file named cert.inf with the following contents:

[Version]Signature = "$Windows NT$"[Strings]szOID_ENHANCED_KEY_USAGE = "2.5.29.37"szOID_CODE_SIGNING = "1.3.6.1.5.5.7.3.3"szOID_BASIC_CONSTRAINTS2 = "2.5.29.19"[NewRequest]Subject = "CN=Contoso, O=Contoso, L=Redmond, S=Washington, C=US"Exportable = trueHashAlgorithm = Sha256KeyLength = 2048RequestType = CertValidityPeriod = "Years"ValidityPeriodUnits = "1"[Extensions]%szOID_ENHANCED_KEY_USAGE% = "{text}%szOID_CODE_SIGNING%"%szOID_BASIC_CONSTRAINTS2% = "{text}"

Replace the subject and validity period, and adjust any advanced settings you need per the docs (or more likely found on the web). Then do the following:

1. certreq -new cert.inf cert.cer
2. Double-click the resulting cert.cer and install it to the Trusted Root Certificate Authorities store (either user or machine).
3. certreq -accept -user cert.cer OR certreq -accept -machine cert.cer (depending on the store you picked in the previous step).
4. Go to the Personal store in the cert manager (user or machine scope, depending on what you picked above) and find the cert you just installed. Double-click it and copy the serial number from the details tab (I encountered some voodoo here where the cert would only show up after a long time, or after I installed a different cert (with a different subject name).
5. certutil -exportpfx -p "YOUR_PFX_PASS" my SERIAL_NUMBER foo.pfx (replace the password and the serial number with their actual values)

You should now have a valid store pfx.

Yet another option for even more advanced generation

Use OpenSSL. Pretty sure it can do all the above and more, but I haven't tried it personally so you'll have to figure it out - and hopefully share here once you do!