If you’re working with Windows binaries, you’ve probably noticed that some programs won’t run smoothly on other machines. Windows has security features that check if software is signed with a trusted digital certificate. Signing your code helps it run without warnings and boosts trust, especially when sharing software publicly.

Why You Might Need a Code-Signing Certificate

When you create software on Windows, signing it with a digital certificate proves it’s legitimate. For distributing to a broad audience, buying a certificate from a trusted provider like Verisign, Thawte, or Comodo is the best route. These certificates confirm your identity and ensure your software isn’t tampered with. They start at around $129 a year and can go over $600, depending on the level of trust you want.

Higher-tier certificates, such as Extended Validation (EV) ones, offer stronger guarantees. They often come with extra protections like hardware tokens that store the certificate securely. If you develop drivers for Windows, you’ll need an EV certificate to meet Microsoft’s requirements. These certificates also help your signed programs pass Microsoft’s SmartScreen checks, reducing the chance of warnings or blocks during downloads.

Creating Your Own Self-Signed Certificate for Testing

If you’re just testing or developing, you don’t have to buy a certificate. You can generate a self-signed one. This type isn’t trusted outside your own environment but works well for internal testing. It’s quick to create using built-in tools in Windows 11 and Windows Server 2025. The PowerShell command New-SelfSignedCertificate simplifies this process.

To generate your own test certificate, start by opening your Certificate Manager in Windows. This is accessible by searching for “user certificates” in the Start menu. Once open, you’ll see your current certificates. Then, open PowerShell as an administrator and run the command to create a fake root authority, which acts like a trusted issuer on your machine. The command will look something like this: $rootCert = New-SelfSignedCertificate -CertStoreLocation Cert:\CurrentUser\My -DnsName “FakeCA” -Type CodeSigning”. After executing it, a new certificate named FakeCA appears in your certificate store, ready for use.

Next, you’ll want to export this certificate so you can reuse it. Exporting involves saving it as a .pfx file, which includes the private key. You can do this through the MMC interface or with PowerShell commands. Protecting the private key with a password is essential, even for testing certificates, to prevent misuse.

Once your root certificate is ready and exported, you can sign your binaries using tools like SignTool, which is included with Visual Studio. If you don’t have Visual Studio, you can install just the command-line components through the Visual Studio Build Tools. Running SignTool from an administrator PowerShell prompt allows you to sign your code, making it ready for testing or internal distribution.

Signing Code with a Trusted Certificate from a CA

If you need your binaries to be trusted by everyone, buying a code-signing certificate from a CA is the way to go. These certificates are verified and recognized by Windows and other operating systems. The process involves obtaining the certificate, often requiring proof of your identity, and then using tools like SignTool to sign your binaries.

The main advantage of CA certificates is that they are part of a chain of trust. This means your software can be trusted on other machines without warnings. These certificates also help your programs bypass Windows SmartScreen prompts, which can block or warn about untrusted software. If you develop drivers, an EV certificate is mandatory for Windows certification.

Whether you choose to buy a certificate or generate a self-signed one for testing, signing your Windows binaries is straightforward once you have the right tools. It adds a layer of security and trust that benefits both developers and users. With a little setup, you can ensure your software runs smoothly and securely across Windows systems.

Inspired by

• https://www.infoworld.com/article/4034249/how-to-code-sign-binaries-on-windows.html

Sources

• gmpg.org
• ssl.com
• microsoft.com
• microsoft.com
• siia.net