Windows Code Signing: Complete Guide

Windows code signing adds a cryptographic signature to software so Windows and other verification systems can establish the publisher identity, check whether the signed data has changed, and evaluate the certificate and its trust chain.

The process involves more than attaching a certificate to an EXE. A signing tool creates a signature with the private key, the certificate identifies the publisher, a timestamp created through code signing timestamping can preserve signing-time evidence, and Windows evaluates the resulting signature through its certificate and platform verification processes.

The practical model: build the file, calculate its signing data, sign with the protected private key, add timestamp evidence, then verify the signature, certificate and chain before release.
Windows VERIFIED signature + identity
Software EXE, DLL, MSI, drivers and other supported Windows formats
Publisher identity Certificate identifies the organization or individual represented by the signature
Verification Signature, certificate, chain, validity and applicable Windows policies

How does Windows code signing actually work?

Windows code signing is a cryptographic process that associates signed software with a certificate and its publisher identity. The signing operation uses the private key corresponding to the certificate. Windows can then inspect the signature, validate the certificate and build a code signing certificate chain when evaluating the signed file.

01 · File Software binary The release artifact is prepared before signing.
→
02 · Cryptography Signing operation The private key is used to create the digital signature.
→
03 · Verification Windows evaluates The signature, certificate and applicable trust information are checked.
software.exe  →  hash / signing data  →  private key  →  digital signature  →  Windows verification

What Is Windows Code Signing?

Windows code signing is the process of applying a digital signature to supported software using a code signing certificate and its corresponding private key.

The signature provides cryptographic evidence about the signed content and associates the release with the identity represented by the signing certificate.

What the signature can establish

  • The signed content can be checked for modification after signing.
  • The certificate identifies the publisher represented by the signing credential.
  • The certificate can be evaluated through its applicable trust chain.
  • A timestamp can provide evidence of when the signature was applied.
File → signature → publisher
Windows application
File setup.exe
Content PE executable
State Unsigned
→
Signed release
Signature Present
Certificate Publisher identity
Timestamp Signing evidence
The certificate does not itself perform the signing. The private key associated with the certificate performs the cryptographic signing operation, so private-key protection is central to release security.

How Windows Code Signing Works

A typical Windows release moves through a sequence from build artifact to signed and verified software. The exact tooling can vary, but the core signing model remains the same.

Build Create release artifact
Prepare Calculate signing data
Sign Use protected private key
Timestamp Add trusted time evidence
Verify Check before release
Signing should normally happen after the release artifact has been finalized. If the signed file is changed afterward, its signature may no longer validate as expected. Software signature verification before deployment checks the artifact that is actually being released.

What Windows Actually Verifies

A valid code signature is not simply a green check attached to a file. Verification involves multiple pieces of evidence. Windows can inspect the signature and certificate and may perform additional certificate and policy checks depending on the context.

Verification signals
01
Signature integrity Does the signature correspond to the signed data?
CHECK
02
Certificate Is the signing certificate appropriate and valid?
CHECK
03
Certificate chain Can the certificate chain be established to a trusted root?
CHECK
04
Validity and status Are applicable validity and certificate-status checks satisfied?
CHECK
Verification result
Signed

A successful signature check means the cryptographic signature can be validated for the signed content under the applicable verification conditions.

This does not by itself mean the application is malware-free or vulnerability-free.
Important distinction: signature validity, publisher identity and application reputation are related to software trust, but they are not the same thing.

Windows Code Signing and Authenticode

Microsoft Authenticode is the technology for signing Windows software and verifying publisher identity and file integrity through digital signatures and certificates.

For PE files such as Windows executables and libraries, the signature is associated with the file in a way that allows Windows and supporting tools to retrieve and validate the signing information.

Keep the terminology separate: Authenticode is the Windows signing technology. The code signing certificate is the credential used to establish the signing identity.
Simplified Authenticode model
PE file
Headers PE structure
Sections Program content
Signature area Certificate table
→
Verification evidence
Signature Cryptographic proof
Certificate Publisher
Chain Trust path
This is a conceptual view of the signing structure, not a byte-level representation of the PE format.

Windows signing depends on Authenticode and trusted verification

Keep the signing technology, certificate identity, private key and verification result distinct when designing a Windows release process.

Microsoft Authenticode

What Can You Sign on Windows?

Windows code signing applies to multiple types of software and release artifacts. The exact signing requirements vary by file format and use case.

Windows publisher identity One signing identity can be used across supported release artifacts when the signing workflow and format allow it.
→
EXEApplications
DLLLibraries
MSIInstallers
SYSDrivers
ScriptsPowerShell and related workflows
OtherSupported Windows artifacts
Artifact Typical role Signing consideration
EXE Windows application or executable Common Authenticode signing target.
DLL Windows library Can be signed independently when the release process requires it.
MSI Windows installer Signing the installer does not automatically sign every file installed by it.
SYS Windows driver Drivers are subject to additional Windows driver-signing requirements and policies.
PowerShell and scripts Script distribution Script signing uses the applicable Windows scripting trust model rather than treating every script as a PE binary.

Windows Code Signing Certificates

The certificate identifies the publisher represented by the signing credential. For Windows publishing, organization and individual identity models can be relevant, while EV is a distinct validation profile where available and applicable.

Organization
Organization / OV

Associates the signing identity with an eligible organization and its validated identity.

Enhanced validation
EV

Provides an enhanced validation profile with additional issuance and key-protection requirements.

Individual
Individual

Where offered and eligible, represents an individual publisher rather than a company.

Certificate type is not the same as signing infrastructure. EV, Organization and Individual describe certificate profiles. Local signing, HSM signing and cloud signing describe how the private key is protected and operated.

How to Sign Windows Software

A production signing workflow needs the certificate, the corresponding private key, a signing tool, an appropriate timestamping service and a finalized release artifact.

  • Obtain an appropriate Windows code signing certificate.
  • Protect the corresponding private key.
  • Prepare the final EXE, DLL, MSI or other supported artifact.
  • Use an appropriate Windows signing tool.
  • Add a trusted timestamp when supported by the workflow.
  • Verify the signed artifact before distribution.
Signing desk
01 · Credential Certificate + private key Publisher identity and signing capability.
→
02 · Tool SignTool or equivalent Performs the signing operation against the release artifact.
→
03 · Evidence Signature + timestamp Final signed artifact is ready for verification.

SignTool and Windows Code Signing

SignTool is Microsoft's command-line utility for signing, verifying and working with signatures on Windows software. It is commonly incorporated into build and release processes because it can be called directly from scripts and CI/CD jobs.

The exact command depends on how the certificate and private key are stored and accessed. Production environments should avoid exposing signing credentials unnecessarily.

Signing tool vs certificate: SignTool performs the operation. It does not become the certificate, replace the private key or determine the publisher identity.
Windows Terminal
PS C:\release> signtool sign /fd SHA256 /a /tr https://timestamp.example /td SHA256 app.exe

Successfully signed: app.exe
Signature: valid
Timestamp: present
Example structure only. Use the current SignTool syntax and a real timestamping endpoint in an actual signing workflow.

How to Verify a Windows Digital Signature

Windows provides graphical and command-line ways to inspect a signed file. For a common EXE or DLL, the file's Properties dialog can expose the Digital Signatures information when a signature is present.

SignTool can also be used to verify signatures in automated release checks.

  • Check whether a signature is present.
  • Inspect the signer and certificate details.
  • Check the certificate chain and validity information.
  • Verify the final artifact from the exact build being distributed.
Windows file properties
app.exe Properties
General Compatibility Digital Signatures Details
✓
Code Signing Certificate Publisher identity represented by the signer
Valid
The exact Windows interface can vary by Windows version and file type. This visual represents the verification concept, not a screenshot of a particular Windows release.

How Windows Builds the Certificate Chain

A code signing certificate is part of a Public Key Infrastructure chain. During certificate validation, Windows can build a path from the signing certificate through intermediate certificates toward a trusted root, subject to applicable trust and policy checks.

Trusted Root CA Trust anchor available to the system
↓
Intermediate CA Certificate authority chain component
↓
Code Signing Certificate Represents the publisher identity
↓
Signed Windows Software EXE, DLL or other applicable signed artifact
A valid signature and a trusted certificate chain are separate checks. A signature can be mathematically valid while certificate-chain or trust evaluation still produces a problem.

How Windows Determines the Publisher

The publisher shown for signed software comes from the identity represented in the signing certificate and the way Windows validates that certificate.

This is why the certificate's subject and associated certificate information matter. The name displayed to users should correspond to the legitimate publisher represented by the certificate.

Publisher identity is not the same as reputation. A certificate can identify a legitimate publisher without guaranteeing that Windows will consider every release highly reputable.
Identity propagation
Certificate
Example Software Ltd.
Validated publisher identity
→
Signed release
ExampleApp.exe
Publisher identity can be inspected through the signature

Windows SmartScreen vs Code Signing

Code signing and SmartScreen are not interchangeable. A valid digital signature provides publisher and integrity evidence. SmartScreen uses additional security and reputation signals when deciding whether to warn about an application or download.

Code signing answers

Who signed this? Certificate identifies the publisher represented by the signer.
Was the signed content changed? Cryptographic verification checks the signed data.
Can the certificate be trusted? Windows can evaluate the certificate and its chain.

SmartScreen answers

Should this download or application raise a warning? Additional reputation and security signals can influence the outcome.
Is this software familiar and trusted? Reputation is distinct from certificate identity.
Is there a security concern? Microsoft's security systems can consider signals beyond the certificate.
A valid code signature does not guarantee a SmartScreen warning-free experience. Certificate validation and application reputation are separate parts of the overall Windows trust experience.

What Happens When Windows Cannot Verify a Signature?

A failed verification can have several causes. The useful troubleshooting approach is to identify which part of the trust path failed rather than treating every warning as a generic certificate problem.

Windows cannot establish the expected trust result
Signature problem Signed data or signature cannot be validated.
Certificate problem Certificate is expired, invalid or otherwise unsuitable.
Chain problem Trust chain cannot be established as expected.
Policy or reputation Platform policy or reputation produces a warning.
The appropriate response depends on the exact verification result. Do not replace a certificate merely because a SmartScreen or application warning appears.

Common Windows Code Signing Errors

Most signing failures can be narrowed down by separating the signing operation from the later verification process.

Problem Likely area to inspect First diagnostic step
SignTool cannot find a certificate Certificate store or certificate selection Check certificate availability and intended certificate selection.
Private key unavailable Private-key access Confirm the signing identity has access to the corresponding private key.
Signature verification fails Artifact integrity or signature Verify the exact artifact that was signed and inspect the signature.
Certificate chain warning PKI trust Inspect the complete certificate chain and system trust configuration.
Timestamp problem Timestamping service or response Check the timestamp configuration and resulting signature evidence.
SmartScreen warning Reputation/security layer First verify that the digital signature itself is valid before diagnosing reputation.

Windows Code Signing With CI/CD

Automated signing allows development teams to apply signatures consistently during release builds. The main security requirement is controlled access to the private key.

A strong pipeline signs the finalized artifact, verifies the resulting signature and prevents uncontrolled access to signing credentials.

  • Keep signing credentials out of source repositories.
  • Limit which pipeline jobs can invoke signing.
  • Sign only finalized release artifacts.
  • Verify the signature after signing.
  • Keep release and signing logs for auditability.
Release pipeline
Commit Source change
Build Release artifact
Sign Protected key
Timestamp Time evidence
Verify Signature check
Release Distribution

Windows Code Signing With an HSM

A Hardware Security Module can provide hardware-backed protection for signing keys. In an enterprise signing architecture, the build system can request a signing operation without exposing the private key as an ordinary exportable file.

01 · Pipeline Build server Produces the finalized Windows artifact.
02 · Authorization Signing request Controlled identity invokes the signing operation.
03 · Protection HSM Private key remains protected inside the signing infrastructure.
04 · Output Signed artifact Pipeline receives the resulting signed release.
HSM architecture can improve private-key protection, but HSM use does not itself determine whether the certificate is EV, Organization or Individual.

Windows Code Signing With Cloud Signing

Cloud signing moves the signing operation into a remote service while keeping the signing credential under controlled infrastructure. This can be useful when release teams need centralized key management across distributed build environments.

01 · Build CI/CD runner Creates and prepares the Windows release.
02 · Request Signing API / service Receives an authorized signing request.
03 · Protected key Remote signing infrastructure Signing credential is operated within controlled infrastructure.
04 · Return Signed Windows artifact Release pipeline receives the signed output for verification.
Cloud signing changes key operation, not publisher identity. The certificate profile and the remote signing architecture answer different questions.

Protect the signing key throughout the release process

Limit signing access, keep private-key operations controlled, and verify the final artifact before it reaches users.

Sign Software Without Exposing the Private Key

Windows Code Signing Best Practices

A reliable signing setup treats the private key as a high-value release credential and makes verification part of the release process rather than an optional manual check.

01
Protect the private key Use appropriate certificate storage and access controls.
02
Sign finalized artifacts Do not modify the release after signing unless the signing process is repeated.
03
Use timestamping Include trusted signing-time evidence where appropriate.
04
Verify after signing Make signature verification an explicit release gate.
05
Automate carefully Limit which CI/CD identities and jobs can invoke signing.
06
Monitor certificate lifecycle Track expiration, replacement and applicable certificate-status events.

Windows Code Signing Workflow Example

Consider a software company preparing version 4.2 of a Windows desktop application. The release process can separate software compilation, signing, verification and distribution into explicit stages.

Version 4.2 release
Build 4.2 Generate EXE and DLL
Freeze files Final artifacts
Sign Private key operation
Timestamp Signing-time evidence
Verify Signature and chain
Publish Distribute release
The critical boundary is between signing and release. Once the final artifact is signed and verified, the distributed file should be the same artifact that passed those checks.

Windows Code Signing Troubleshooting Checklist

When something goes wrong, work from the signing operation outward. This avoids treating certificate, signature, chain and reputation problems as one issue.

Is the file signature valid?
No Inspect the signed artifact, signing operation and file integrity.
Yes, but chain fails Inspect certificate chain, trust configuration and certificate status.
Yes, but warning remains Determine whether the remaining issue is policy, reputation or another security signal.
  • Verify the exact file that was distributed.
  • Inspect the certificate and signer information.
  • Check the complete certificate chain.
  • Check certificate validity and applicable status information.
  • Confirm timestamp information when present.
  • Separate SmartScreen reputation warnings from signature failures.

Make Windows signing part of a controlled release pipeline

Automated signing should use approved build artifacts, restricted credentials, traceable signing events and a verification step before deployment.

Automate Code Signing in CI/CD

Common Misconceptions About Windows Code Signing

“A valid signature means the software is safe.”
A signature establishes cryptographic and publisher evidence. It is not a malware scan or vulnerability assessment.
“EV guarantees SmartScreen trust.”
No. Certificate validation and reputation/security systems are distinct. EV does not guarantee a particular SmartScreen result.
“The certificate signs the EXE.”
The private key performs the cryptographic signing operation. The certificate provides the public identity and certificate information used during verification.
“SignTool is a certificate.”
No. SignTool is a Windows signing and verification utility.
“HSM is a certificate type.”
No. HSM is private-key protection infrastructure. It is separate from certificate validation and publisher identity.
“Signing an MSI signs everything inside it.”
Signing the installer and signing the files contained in the installation package are separate considerations.
“A certificate chain problem means the signature itself is fake.”
Not necessarily. Signature integrity and certificate-chain trust are separate parts of verification.

Frequently Asked Questions

What is Windows code signing?

Windows code signing is the process of applying a digital signature to supported software using a code signing certificate and its corresponding private key. Windows can use the resulting signature and certificate information to evaluate publisher identity and signed-content integrity.

How does Windows verify a code signature?

Windows can verify the cryptographic signature, inspect the signing certificate, build the certificate chain and perform applicable validity, status and policy checks.

What is Authenticode?

Authenticode is Microsoft's technology for signing and verifying Windows software using digital signatures and certificates. It is not a separate certificate type.

What is SignTool used for?

SignTool is a Microsoft command-line utility used to sign, verify and work with digital signatures on Windows software. It is commonly integrated into automated code signing in CI/CD pipelines.

Does code signing stop SmartScreen warnings?

Not necessarily. Code signing provides publisher and integrity evidence, while SmartScreen uses additional reputation and security signals. A valid signature does not guarantee a warning-free SmartScreen result.

Can an EXE and DLL use the same code signing certificate?

A publisher can use an appropriate signing certificate across supported software artifacts when the certificate, signing workflow and target format permit it. The file extension does not by itself define a different certificate type.

Does signing an MSI sign the files inside it?

Not automatically. The signature on an installer and signatures on the files delivered by that installer are separate signing considerations.

Is an HSM required for Windows code signing?

The answer depends on the certificate profile, current CA requirements and your signing architecture. An HSM is a key-protection mechanism, not a certificate type. Cloud code signing is another option when its controls fit the release environment.

What happens if the signing certificate expires?

Certificate expiration can affect new signing operations and how signatures are evaluated. Timestamp evidence can be important when evaluating signatures created while the certificate was valid, subject to applicable verification rules.

Why does Windows show an unknown publisher?

An unknown publisher result can occur when Windows cannot establish the expected signer or certificate trust information. The signature, certificate, chain and system trust configuration should be inspected separately.

The Windows signing model to remember

Software → the artifact being released · Private key → creates the signature · Certificate → represents the publisher · Chain → establishes certificate trust · Windows → applies verification and platform policies

Related Windows Code Signing Resources

Continue into the focused guides when you need implementation details for a specific Windows signing task.

Windows Authenticode Microsoft's signing technology for Windows software and publisher verification. Windows Authenticode
Windows EXE Signing Signing considerations for executable files and the verification of the released binary.
Windows DLL Signing Signing considerations for Windows libraries and their publisher signatures.
Software Package and Installer Signing Signing installers and distinguishing package signatures from signatures on included files. Software Package and Installer Signing
Software Signature Verification Check the signature, signer identity and certificate trust before software deployment. Software Signature Verification Before Deployment
Windows SmartScreen Distinguish certificate and signature validity from application reputation and security warnings.
Windows Code Signing Errors Diagnose common signing, certificate-chain and verification problems.
Windows Code Signing in CI/CD Build controlled automated signing workflows for Windows releases. Automated Code Signing in CI/CD