I use the next command sequence (it's a part of my cmd file. Certificate is stored in a file on hard drive. If you want to sign your installer by the certificate from the store just fix signing part. All result code check is omitted)
set INSIGNIA_PATH="C:\Program Files (x86)\WiX Toolset v3.8\bin\insignia.exe"
rem Detach engine
del /q engine.exe
%INSIGNIA_PATH% -ib Setup.exe -o engine.exe
rem Sign engine
SignTool.exe sign /f certificate.pfx /p CERT_PASSWORD /t TIMESTAMP_URL engine.exe
rem Attach engine
%INSIGNIA_PATH% -ab engine.exe Setup.exe -o ProductSetup.exe
rem Sign bundle
SignTool.exe sign /f certificate.pfx /p CERT_PASSWORD /t TIMESTAMP_URL ProductSetup.exe