---
description: >-
  Code signing is essential for ensuring the integrity and authenticity of
  software. By digitally signing your .exe files, you can assure users that the
  software is legitimate and has not been tampered
---

# How to Sign an .exe File in Windows

### Prerequisites

Before you begin, ensure you have the following:

1. **Code Signing Certificate**: Obtain a code signing certificate from a trusted Certificate Authority (CA) such as **DigiCert**, **Comodo**, or **GlobalSign**.
2. _**SignTool**:_ This tool is part of the [**Windows SDK**](https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/). If you don't have it installed, you can download the Windows SDK from the Microsoft website.

### Step-by-Step Guide

#### Step 1: Install the Windows SDK

1. Download the Windows SDK from the **Microsoft website**. \[[Installer](https://go.microsoft.com/fwlink/?linkid=2272610)]\[[iso](https://go.microsoft.com/fwlink/?linkid=2272523)]
2. Run the installer and follow the on-screen instructions.
3. Ensure you include the "_Windows SDK Signing Tools for Desktop Apps_" during installation.

#### Step 2: Obtain a Code Signing Certificate

1. Purchase a code signing certificate from a trusted CA.
2. Follow the instructions provided by the CA to download and install your certificate. Typically, this involves generating a Certificate Signing Request (CSR) and submitting it to the CA.

#### Step 3: Locate SignTool

After installing the Windows SDK, locate `SignTool.exe`. It is usually found in:

```
C:\Program Files (x86)\Windows Kits\10\bin<version>\x64\SignTool.exe
```

### Step 4: Sign the .exe File

Open Command Prompt as an administrator and navigate to the directory containing `SignTool.exe` and your `.exe` file. Use the following command to sign your file:

```batch
signtool sign /a /t http://timestamp.digicert.com /v path\to\yourfile.exe
```

* [x] `/a`: Automatically selects the best signing certificate.
* [x] `/t`: Specifies the timestamp server URL. This is crucial as it ensures the signature remains valid even after the certificate expires.
* [x] `/v`: Enables verbose output, showing detailed information about the signing process.
* [x] `path\to\yourfile.exe`: Replace with the actual path to your `.exe` file.

### Step 5: Verify the Signature

To verify that your `.exe` file has been correctly signed, use the following command:

```batch
signtool verify /pa /v path\to\yourfile.exe
```

* [x] `/pa`: Specifies that the Default Authenticode Verification Policy should be used.
* [x] `/v`: Enables verbose output.



If the signing process was successful, you should see a message indicating that the signature is valid.

### Conclusion

By following these steps, you can ensure that your `.exe` files are securely signed, providing assurance to your users about the authenticity and integrity of your software. Code signing not only helps in building user trust but also complies with various security policies and platform requirements.
