Complete Guide: Code Signing EXE, DLL, and MSI Files
Unsigned software gets the scary treatment: SmartScreen interstitials, browser warnings, antivirus suspicion, enterprise policy blocks. Code signing is the foundation for fixing all of it, although SmartScreen reputation still has to build over time. With the 2023+ hardware-key rules and certificates now capped at 460 days, doing it efficiently takes some planning. This is the complete practical guide.
What Code Signing Proves
- Identity — the binary comes from a verified publisher (your company name in the UAC prompt instead of "Unknown Publisher").
- Integrity — one flipped bit invalidates the signature; tampering is detectable.
- Longevity — with an RFC 3161 timestamp, the signature stays valid after your certificate expires.
Standard vs EV Certificates
| Standard (OV) | EV | |
|---|---|---|
| SmartScreen reputation | Builds over time with downloads | Builds over time too (EV no longer bypasses SmartScreen) |
| Maximum validity (issued from 1 March 2026) | 460 days | 460 days |
| Key storage (2023+) | Hardware required | Hardware required |
| Kernel-mode drivers | No | Required (with Microsoft signing) |
| Verification depth | Organisation validation | Extended business verification |
Since June 2023 all code-signing keys must live on certified hardware — so the "convenience" gap between standard and EV has closed: both end up on a token (or in a paid cloud HSM). Need a certificate? OneSigner supplies them on 1, 2 or 3-year plans depending on the CA (each certificate is issued for up to 460 days and re-issued free of charge each time it expires during the term), bundled with a free thumbprint-locked OneSigner license.
What to Sign
Everything you ship: the installer (.msi/.exe), the application executables, your own DLLs, drivers (.sys), and PowerShell scripts your installer runs. Users encounter the installer first — an unsigned installer wrapped around signed binaries still triggers SmartScreen.
The Automation Problem — and Three Solutions
Hardware tokens prompt for a PIN. Great for security, fatal for unattended builds. OneSigner removes the prompt while the key stays in hardware:
1. Folder watch
Drop binaries into a watched folder; signed output appears next door. Zero integration.
2. REST API
curl -X POST "https://sign.yourcompany.com/api/upload?download=true" \
-H "Authorization: Bearer $TOKEN" \
-F "file=@myapp.exe" -o myapp-signed.exe3. Remote signing with OneSignTool
AzureSignTool-compatible: build machines send only the file hash; the token stays on your signing server. Ideal for cloud CI. Full guide.
Non-Negotiables
- Always timestamp (
/tr http://ts.ssl.com /td sha256or your CA's TSA) — otherwise everything you shipped "expires" with the certificate. - SHA-256 or better digests (sha384 for ECC certs).
- Scan before signing — OneSigner can run Windows Defender on every file first; your signature is your reputation.
- Control the certificate — restrict which pipelines can sign (per-partner codes, thumbprint allowlists).
Verify Your Work
signtool verify /pa /v myapp-signed.exeOr right-click → Properties → Digital Signatures. Check both the signature and the timestamp counter-signature.
Step-by-step setup: Code Signing Setup · CI recipes: Code Signing in CI/CD
Related: Shipping a ClickOnce application instead? That one has its own quirks: code signing for Visual Studio ClickOnce deployments.