Microsoft Authenticode: Complete Guide
Microsoft Authenticode is the signing technology used to attach and verify digital signatures for supported Windows software. It brings together the software artifact, cryptographic signature, signer certificate, certificate chain and signing-time information so that Windows can evaluate who signed the file and whether its signed content remains intact.
Authenticode is therefore more than a certificate and more specific than the general term code signing. For Windows developers, publishers and security teams, the important question is how these pieces work together during signing and verification.
What is Microsoft Authenticode?
Microsoft Authenticode is a digital-signature technology for signing supported Windows software and other supported Windows artifacts. It provides a way for a publisher to associate a cryptographic signature with software and to identify the signer through a digital certificate. When the signed artifact is later inspected, Windows can use the signature and certificate information to evaluate integrity, identity and trust.
The distinction between the individual components matters. A code signing certificate represents the signer's identity and contains a public key. The corresponding private key is used to create the signature. The digital signature is the cryptographic result. The certificate chain connects the signer certificate to certification authorities, while a timestamp can provide evidence about when the signature was created.
Authenticode is the technology that brings these pieces into the Windows software signing and verification process. That is why describing Authenticode simply as a "certificate" misses the most important part of how Windows software signing actually works.
Six components, six different jobs
Authenticode becomes easier to understand when the signing system is separated into its individual components. The software is what gets signed, the private key creates the signature, and the certificate provides the public identity needed to interpret that signature.
The chain and timestamp then add trust and signing-time context. None of these elements should be treated as interchangeable.
Windows software
The executable, library, installer or other supported artifact that the publisher intends to release.
Digital signature
The cryptographic result that allows the verifier to determine whether the signed information is consistent with the signer key.
Signer certificate
The certificate identifies the signer and supplies the public key used during signature verification.
Certificate chain
The chain provides the path from the signer certificate toward an authority that Windows can recognize as trusted.
Timestamp
Timestamp information provides evidence associated with the time at which the software was signed.
Windows evaluation
Windows evaluates the signature and related certificate information according to the artifact and applicable security and trust rules.
What Authenticode actually provides
Authenticode addresses a specific problem in software distribution: how can a recipient determine who signed a Windows software artifact and whether the signed content has remained consistent with the signature?
That makes Authenticode useful for software publishers because a signed application can carry information that users, operating systems and software-management tools can inspect. It also gives administrators a cryptographic mechanism for evaluating publisher identity instead of relying only on a filename or an icon.
At the same time, a valid signature should not be interpreted as a guarantee that the software is safe. Signing establishes information about the signer and the integrity of signed content. It does not prove that an application has no vulnerabilities, unwanted behavior or malicious functionality.
A Windows signing technology
It defines how digital signatures and related certificate information are associated with supported Windows software and subsequently evaluated.
A code signing certificate
The certificate is an identity credential used by the signing and verification process. It is only one component of the overall Authenticode system.
A cryptographic signing mechanism
The signing process creates a cryptographic relationship between the signed artifact and the signer's private key.
Software encryption
Signing does not hide the contents of an application. Encryption and digital signatures solve different security problems.
How Authenticode signing works from build to release
The signing operation normally happens after the final software artifact has been built. The publisher then signs that artifact, associates the signer certificate, obtains timestamp information when required, and verifies the resulting file before distribution.
Build
Produce the final Windows artifact that will be released.
Digest
Calculate the cryptographic digest for the relevant signed content.
Sign
Use the protected private key to create the digital signature.
Associate
Associate signature and certificate information with the artifact.
Timestamp
Obtain signing-time evidence from a trusted timestamping service.
Verify
Confirm the released artifact can be successfully verified.
Authenticode and PE/COFF files
Portable Executable, commonly called PE, is the Windows executable format used by applications and many system components. Familiar Windows files such as EXE and DLL files are commonly based on the PE format.
Authenticode signing for PE files is integrated with the structure used by Windows to represent certificate information. The signature is therefore not simply a random block of bytes placed at the end of the executable. The PE format provides a defined location and structure through which certificate information can be identified.
This distinction becomes important when explaining verification. Windows needs to locate the signature information, reconstruct the relevant file digest according to the Authenticode hashing rules, inspect the signing data and then evaluate the certificate and trust information associated with the signature.
You don't need to understand every field in the PE specification to work with Authenticode, but understanding the relationship between the PE structure and the embedded signature makes many signing and verification errors much easier to diagnose.
What is the Attribute Certificate Table?
PE files contain a data-directory entry that points to certificate information associated with the image. This is commonly referred to as the Attribute Certificate Table. It gives software that understands the PE format a defined place to locate certificate and signature data.
The certificate table is different from ordinary executable sections. Its contents are associated with the signed image but are not treated as normal executable code. This distinction matters because the Authenticode hashing process has specific rules for which portions of the PE file contribute to the digest.
Inside this area, structures such as WIN_CERTIFICATE can contain the encoded signature information. The signature can in turn contain signer certificate data and related cryptographic information used during verification.
| Element | Role in the signing structure | Why it matters |
|---|---|---|
| PE/COFF image | The Windows executable structure being signed. | Defines the artifact and its internal layout. |
| Certificate table | PE location used to identify certificate information. | Allows verification software to locate signing data. |
| WIN_CERTIFICATE | Structure associated with the certificate table. | Provides the container for the encoded certificate/signature data. |
| Signature data | Cryptographic information produced during signing. | Allows the signed content and signer information to be evaluated. |
How hashing fits into Authenticode
A digital signature doesn't require Windows to compare two complete executable files byte by byte in the way a user might compare files. The signing process creates a cryptographic digest from the relevant signed content, and that digest becomes part of the signature process.
During verification, Windows can calculate the corresponding digest again. If the relevant content has changed, the resulting digest will no longer correspond to the value protected by the signature.
Signed file
The final application is processed according to the Authenticode hashing rules.
PE/COFF content
Cryptographic digest
The relevant signed content is represented by a fixed-length digest.
8D71...4C29
Digital signature
The signing operation protects the digest using the signer's private key.
verified with public key
What is contained in an Authenticode signing package?
An Authenticode signature isn't simply a yes/no flag attached to a Windows executable. The signing information provides cryptographic material that allows the verifier to inspect the signature and identify the certificate used by the signer.
The signer certificate contains the public key corresponding to the private key used for signing. The certificate also contains identity and issuer information. Additional certificate information can be used when constructing and evaluating the certificate chain.
The signature data can also carry information related to the signature algorithm, signed attributes and timestamping. These elements provide the context needed to evaluate the signature rather than treating it as an isolated cryptographic number.
For PE files, these signing structures are associated with the certificate table described earlier. This is why Authenticode is closely connected to both Windows cryptography and PE file structure.
Follow the signature from file to result
Start with the signed artifact and locate its signature information. Then identify the signer certificate and examine the public key and certificate issuer.
Continue through the certificate chain, inspect timestamp information where present, and finally check the signature and file-integrity result.
This sequence is useful when building a signature inspection tool or diagnosing why a signed Windows file isn't being accepted as expected.
Certificate, private key and signature are not the same thing
These terms are often used together in code signing documentation, but each has a distinct role in the cryptographic process.
Represents signer identity
The code signing certificate contains the public key and identifies the certificate subject and issuing authority. It is information that can be distributed with the signature.
Creates the signature
The private key is the secret cryptographic key used by the signing operation. It should remain protected and should not be distributed with the software.
Protects the signed relationship
The signature is the cryptographic result generated from the signing operation. A verifier uses the corresponding public key to validate it.
Establishes trust context
The chain connects the signer certificate to its issuing authorities and ultimately toward a trust anchor recognized by the verifier.
What does Windows verify in an Authenticode signature?
Windows signature verification is a layered process. Checking whether the certificate is inside its validity period is only one part of the evaluation. The verifier also needs to establish that the signature structure is usable, that the signed content corresponds to the signature, and that the signer certificate and chain can be evaluated in the relevant trust context.
The exact behavior can vary with the artifact, operating-system component, certificate state, available revocation information and applicable security policy. A useful mental model is therefore to treat verification as a sequence of related checks rather than one certificate lookup.
Verification target
Windows starts with the signed artifact and follows the available signature information toward a final verification result.
MyApp.exe
Example Software Publisher
How Authenticode establishes publisher identity
A Windows executable doesn't become associated with a publisher just because the publisher's name appears in the filename or product metadata. The digital certificate provides the cryptographic identity information used during signature verification.
When the signer certificate is inspected, Windows can display certificate subject information that identifies the organization or individual represented by the certificate. This identity information is useful to users and administrators because it provides something stronger than an unverified software label.
The identity should still be interpreted together with the certificate chain and signature status. A displayed publisher name by itself does not prove that the file's current contents are valid or that the software is safe.
The signer certificate provides identity information that can be presented when the signature is inspected.
How the Authenticode certificate chain works
The signer certificate doesn't normally stand alone. Its issuer information allows the verifier to build a chain through intermediate certificates toward a root certificate that serves as a trust anchor.
A chain problem can therefore produce a different result from a signature-integrity problem. The software may contain a mathematically valid signature while the certificate path cannot be established as trusted in the current environment.
Root CA
Provides the trust anchor.
Intermediate CA
Connects the signer to the issuing hierarchy.
Signer certificate
Represents the software publisher.
Authenticode signature
Protects the signed software relationship.
Why timestamping matters in Authenticode
Code signing certificates have validity periods. Software publishers therefore need to consider what happens to signatures after the certificate that was used for signing reaches its expiration date.
A trusted timestamp provides evidence associated with the time at which the signature was created. This gives verification processes additional information when assessing a historical signature rather than relying only on the certificate's current validity period.
Timestamping doesn't make an invalid signature valid, and it doesn't repair a file that has been modified after signing. Its purpose is to provide signing-time context that can become important throughout the software certificate lifecycle.
Certificate is valid when software is signed
The publisher creates the signature using the private key associated with the code signing certificate.
A timestamp can provide independent evidence associated with the signing operation.
Certificate reaches its expiration date
Expiration doesn't simply transform every historical signature into an unsigned file. The verification process can consider signing-time evidence and other certificate-status information.
Expiration and revocation are not the same
These two certificate events are often confused because both can affect trust evaluation. They represent very different conditions.
| Condition | What it means | Why it matters to Authenticode |
|---|---|---|
| Certificate expiration | The certificate reaches the end of its defined validity period. | Historical signing-time evidence can become important when an old signature is evaluated. |
| Certificate revocation | The issuing authority withdraws the certificate's trust status. | Revocation can affect how a signature is evaluated depending on the verification context and available status information. |
| Invalid file | The relevant signed content no longer matches the signature. | Timestamping doesn't make an altered artifact pass integrity verification. |
What Windows files can use Authenticode signing?
Authenticode is strongly associated with Windows software, but Windows has multiple artifact formats and signing scenarios. The signing workflow and verification requirements should therefore be considered in the context of the artifact being released.
EXE and DLL files are common PE-based examples. MSI packages introduce Windows Installer considerations, while PowerShell uses Windows signing mechanisms appropriate to scripts. Drivers also have additional Windows-specific requirements and should not be treated as ordinary application binaries.
Where SignTool fits into Authenticode
SignTool is a Microsoft command-line utility commonly used in Windows software signing workflows. It provides commands for signing files, verifying signatures, selecting certificates and applying timestamping information.
SignTool doesn't replace the certificate authority, become the signing identity or create trust by itself. It's a tool that performs signing and verification operations using the certificates and keys made available to it.
In a release pipeline, SignTool commonly appears after the final build step. The resulting artifact should then be verified before it is published so that a successful command isn't mistaken for a successfully verified release.
SignTool Code Signing Guide →How to verify an Authenticode signature
Verification can be approached from the graphical Windows interface, command line, scripting environment or application code. The right method depends on whether the goal is a quick user check, release automation or programmatic analysis.
File Properties
Open the file's properties and inspect the Digital Signatures area when available. This provides a convenient way to review signer and signature information manually.
PowerShell inspection
PowerShell can be used to inspect file-signature and certificate information as part of administrative or diagnostic workflows.
Command-line verification
SignTool provides verification functionality suitable for build, release and troubleshooting workflows.
Programmatic verification
Software can use Windows cryptographic and trust APIs when signature verification needs to become part of an application or service.
What happens when an Authenticode-signed file is modified?
One of the most important properties of code signing is the relationship between the signed content and its cryptographic digest. If relevant content is changed after signing, the digest calculated during verification can differ from the value protected by the signature.
This can happen because of legitimate repackaging, post-build modification, file corruption, an attempted signature-stripping operation or malicious tampering. Regardless of the reason, the signature cannot simply be assumed to remain valid after the signed content has changed.
Signature and content agree
The relevant content produces the digest expected by the digital signature.
Signature relationship changes
A change to relevant signed content can produce a different digest, causing signature verification to fail or report an integrity issue.
Authenticode and SmartScreen are not the same thing
A common mistake is to assume that a valid Authenticode signature means Windows will always allow the software without a warning. Authenticode verification and SmartScreen evaluation address different aspects of the Windows security experience.
Authenticode verification
Signature verification focuses on the cryptographic and certificate information associated with the signed artifact.
- Signature integrity
- Signer certificate
- Certificate chain
- Timestamp information
- Applicable trust evaluation
SmartScreen evaluation
SmartScreen can consider broader security and reputation signals when determining how Windows should present or handle downloaded software.
- Reputation signals
- Download context
- Security intelligence
- Publisher and application context
- Windows security policy
Authenticode with HSM and cloud signing
The certificate can be distributed with the software, but the private signing key should be treated very differently. Anyone who gains unauthorized access to the private key may be able to create signatures that appear to originate from the legitimate publisher.
Hardware security modules and cloud signing services address this problem by separating the signing operation from ordinary developer workstations and build environments. The release system can request a signing operation without exposing the underlying private key as a normal exportable file.
HSM-backed signing
The signing key remains inside a protected hardware environment while the build system submits controlled signing requests.
Private key
Cloud signing
A remote signing service can expose a controlled signing interface while keeping the private key inside the provider's protected infrastructure.
service
How Authenticode fits into CI/CD
Windows software is often built automatically, which means signing should be treated as a controlled release stage rather than a manual step performed after the artifact has already been distributed.
A typical pipeline compiles the application, runs tests, produces the release artifact, requests a protected signing operation, applies timestamp information, verifies the result and only then publishes the file.
The most important security boundary is the signing key. Source control, ordinary build jobs and developer machines shouldn't gain unnecessary access to the private key simply because they participate in the release process.
Windows Code Signing in CI/CD →Diagnose Authenticode problems by layer
A failed Windows signature doesn't always mean the cryptographic signature itself is broken. The problem can originate in the file, certificate, certificate chain, timestamp information or the Windows trust environment.
Checking the layers in order avoids jumping directly to certificate replacement when the real problem is a modified file or missing intermediate certificate.
Signature
Is a signature present, readable and cryptographically valid?
File integrity
Does the signed content still correspond to the signature?
Certificate
Is the correct signer certificate present and usable?
Chain
Can Windows build a trusted certificate path?
Windows
Are trust, policy, status or security signals affecting the result?
From MyApp.exe to a verified Windows release
Consider a software publisher preparing a new version of MyApp.exe. The executable is first built and tested. Only after the final binary is ready does the release process request an Authenticode signing operation.
The signing system uses the protected private key associated with the publisher's code signing certificate. The resulting signature is associated with the executable, timestamp information is obtained, and the final file is verified before it is uploaded to the publisher's distribution system.
When a customer later receives the file, Windows can inspect the signature, signer certificate, certificate chain, timestamp and file integrity. Other Windows security systems can then make their own evaluations based on their respective signals.
Authenticode security practices that matter
Authenticode is only as strong as the signing process surrounding it. The certificate can identify the legitimate publisher, but compromise of the private key can allow an attacker to create signatures using that identity.
Security controls should therefore cover the complete signing path: key protection, access control, build integrity, certificate management, timestamping and release verification.
Protect the private key
Keep the signing key in a protected environment and avoid unnecessary export or distribution of key material.
Restrict signing authority
Limit which people, services and pipeline jobs can request signing operations.
Sign the final artifact
Perform the final signing operation after the release binary has passed the required build and test stages.
Verify before distribution
Check the resulting signature, certificate and timestamp rather than assuming the signing operation produced a valid release.
Where Authenticode fits among software signing technologies
Digital signing is a broader concept used across multiple software ecosystems. Authenticode is specifically associated with Microsoft's Windows software signing environment.
| Technology | Main ecosystem | Primary purpose |
|---|---|---|
| Microsoft Authenticode | Windows software | Sign and verify supported Windows software and identify the signer. |
| JAR signing | Java ecosystem | Protect and authenticate signed Java archive content. |
| Apple code signing | Apple platforms | Sign applications and software for Apple's platform security model. |
| Package-specific signing | Software package ecosystems | Apply signing rules defined by the relevant package or distribution ecosystem. |
Authenticode vs code signing
"Code signing" describes the broader practice of digitally signing software. Authenticode is Microsoft's technology for signing and verifying supported Windows software.
Code signing
A general software-security practice used to associate software with a signer and protect the integrity of signed content.
Authenticode
Microsoft's signing and verification technology for supported Windows software and related signing scenarios.
SignTool
A command-line utility commonly used to perform signing and verification operations in Windows release workflows.
What Authenticode does not mean
These distinctions are important when interpreting a Windows signature correctly.
Microsoft Authenticode FAQ
The answers below cover the most common conceptual and technical questions around Windows Authenticode signing.
What is Microsoft Authenticode?
Microsoft Authenticode is a digital-signature technology used to sign supported Windows software and artifacts. It connects the signed software with cryptographic signature information and signer certificate information so that Windows and other software can evaluate identity, integrity and trust.
Is Authenticode the same as code signing?
No. Code signing is the broader practice of digitally signing software. Authenticode is Microsoft's signing and verification technology for supported Windows software.
Is an Authenticode certificate the same as an Authenticode signature?
No. The certificate represents the signer's identity and contains the public key. The digital signature is the cryptographic result produced using the corresponding private key.
What is the private key used for?
The private key is used by the signing operation to create the digital signature. Because control of the private key can allow someone to create signatures using the associated identity, it should be kept in a protected environment.
What is the Attribute Certificate Table?
In a PE file, the Attribute Certificate Table is the structure associated with certificate information for the image. It provides a defined location through which certificate and signature data can be identified and inspected.
What is WIN_CERTIFICATE?
WIN_CERTIFICATE is a PE-related structure used in the certificate table to represent certificate information associated with the signed image. It is part of the technical structure behind PE Authenticode signatures.
What happens if a signed EXE is modified?
If relevant signed content changes after signing, the digest calculated during verification can differ from the value protected by the signature. The signature may then fail verification or report an integrity problem.
Why does Authenticode use timestamping?
A timestamp can provide evidence associated with the time at which a signature was created. This information can become important when evaluating historical signatures after a signing certificate reaches its normal expiration date.
Does a valid Authenticode signature guarantee that software is safe?
No. A valid signature can provide information about the signer and the integrity of signed content. It doesn't guarantee that the software contains no vulnerabilities, unwanted functionality or malicious behavior.
Is Authenticode the same as SmartScreen?
No. Authenticode signature verification evaluates the signing and certificate relationship. SmartScreen can use broader security and reputation signals when determining how Windows should handle or warn about software.
Can Authenticode signatures be used in CI/CD?
Yes. Signing can be incorporated into an automated Windows release pipeline after the final artifact has been built and tested. The private key should remain protected and signing access should be tightly controlled.
Can an HSM be used for Authenticode signing?
A protected hardware security module can be used to keep the private signing key inside a controlled cryptographic environment while allowing authorized systems to request signing operations.
Related Windows code signing resources
These topics cover the practical Windows signing tasks and supporting concepts that sit around Authenticode.
Windows Code Signing Guide
The broader Windows code signing ecosystem, certificates, signing workflows and verification.
Read about Windows Code Signing Guide → ToolSignTool Code Signing Guide
Practical signing, verification, certificate selection and timestamping with SignTool.
Read about SignTool Code Signing Guide → TutorialHow to Sign a Windows EXE
A task-focused walkthrough for signing an executable before release.
Read about How to Sign a Windows EXE → VerificationVerify Windows Signatures
Learn how to inspect signer, certificate, chain, timestamp and signature status.
Read about Verify Windows Signatures → ErrorsWindows Code Signing Errors
Diagnose signature, certificate, chain, timestamp and Windows trust problems.
Read about Windows Code Signing Errors → SecurityWindows SmartScreen
Understand SmartScreen separately from Authenticode signature verification.
Read about Windows SmartScreen → AutomationWindows Code Signing in CI/CD
Integrate protected signing and verification into automated releases.
Read about Windows Code Signing in CI/CD → TechnicalPE Signature Structure
Explore the PE/COFF structures behind Windows executable signatures.
Read about PE Signature Structure →Understand the signature, not just the certificate
Authenticode connects the Windows software artifact, cryptographic signature, publisher certificate, trust chain and signing-time evidence. Once those relationships are clear, signing, verification and troubleshooting become much easier to understand.
Explore Code Signing Solutions →