How to Sign an .exe File in Windows

Code signing is essential for ensuring the integrity and authenticity of software. By digitally signing your .exe files, you can assure users that the software is legitimate and has not been tampered

Prerequisites

Before you begin, ensure you have the following:

1. Code Signing Certificate: Obtain a code signing certificate from a trusted Certificate Authority (CA) such as DigiCert, Comodo, or GlobalSign.

2. SignTool: This tool is part of the Windows SDK. If you don't have it installed, you can download the Windows SDK from the Microsoft website.

Step-by-Step Guide

Step 1: Install the Windows SDK

1. Download the Windows SDK from the Microsoft website. [Installer][iso]

2. Run the installer and follow the on-screen instructions.

3. Ensure you include the "Windows SDK Signing Tools for Desktop Apps" during installation.

Step 2: Obtain a Code Signing Certificate

1. Purchase a code signing certificate from a trusted CA.

2. Follow the instructions provided by the CA to download and install your certificate. Typically, this involves generating a Certificate Signing Request (CSR) and submitting it to the CA.

Step 3: Locate SignTool

After installing the Windows SDK, locate SignTool.exe. It is usually found in:

C:\Program Files (x86)\Windows Kits\10\bin<version>\x64\SignTool.exe

Step 4: Sign the .exe File

Open Command Prompt as an administrator and navigate to the directory containing SignTool.exe and your .exe file. Use the following command to sign your file:

signtool sign /a /t http://timestamp.digicert.com /v path\to\yourfile.exe

• /a: Automatically selects the best signing certificate.

• /t: Specifies the timestamp server URL. This is crucial as it ensures the signature remains valid even after the certificate expires.

• /v: Enables verbose output, showing detailed information about the signing process.

• path\to\yourfile.exe: Replace with the actual path to your .exe file.

Step 5: Verify the Signature

To verify that your .exe file has been correctly signed, use the following command:

signtool verify /pa /v path\to\yourfile.exe

• /pa: Specifies that the Default Authenticode Verification Policy should be used.

• /v: Enables verbose output.

If the signing process was successful, you should see a message indicating that the signature is valid.

Conclusion

By following these steps, you can ensure that your .exe files are securely signed, providing assurance to your users about the authenticity and integrity of your software. Code signing not only helps in building user trust but also complies with various security policies and platform requirements.