Complete Guide: Code Signing EXE, DLL, and MSI Files
Unsigned software gets the scary treatment: SmartScreen interstitials, browser warnings, antivirus suspicion, enterprise policy blocks. Code signing fixes all of it — and with the 2023+ hardware-key rules, doing it efficiently now takes some planning. This is the complete practical guide.
What Code Signing Proves
- Identity — the binary comes from a verified publisher (your company name in the UAC prompt instead of "Unknown Publisher").
- Integrity — one flipped bit invalidates the signature; tampering is detectable.
- Longevity — with an RFC 3161 timestamp, the signature stays valid after your certificate expires.
Standard vs EV Certificates
| Standard (OV) | EV | |
|---|---|---|
| SmartScreen reputation | Builds over time with downloads | Immediate trust |
| Key storage (2023+) | Hardware required | Hardware required |
| Kernel-mode drivers | No | Required (with Microsoft signing) |
| Verification depth | Organisation validation | Extended business verification |
Since June 2023 all code-signing keys must live on certified hardware — so the "convenience" gap between standard and EV has closed: both end up on a token (or in a paid cloud HSM). Need a certificate? OneSigner supplies them, bundled with a free thumbprint-locked OneSigner license.
What to Sign
Everything you ship: the installer (.msi/.exe), the application executables, your own DLLs, drivers (.sys), and PowerShell scripts your installer runs. Users encounter the installer first — an unsigned installer wrapped around signed binaries still triggers SmartScreen.
The Automation Problem — and Three Solutions
Hardware tokens prompt for a PIN. Great for security, fatal for unattended builds. OneSigner removes the prompt while the key stays in hardware:
1. Folder watch
Drop binaries into a watched folder; signed output appears next door. Zero integration.
2. REST API
curl -X POST "https://sign.yourcompany.com/api/upload?download=true" \
-H "Authorization: Bearer $TOKEN" \
-F "file=@myapp.exe" -o myapp-signed.exe3. Remote signing with OneSignTool
AzureSignTool-compatible: build machines send only the file hash; the token stays on your signing server. Ideal for cloud CI. Full guide.
Non-Negotiables
- Always timestamp (
/tr http://ts.ssl.com /td sha256or your CA's TSA) — otherwise everything you shipped "expires" with the certificate. - SHA-256 or better digests (sha384 for ECC certs).
- Scan before signing — OneSigner can run Windows Defender on every file first; your signature is your reputation.
- Control the certificate — restrict which pipelines can sign (per-partner codes, thumbprint allowlists).
Verify Your Work
signtool verify /pa /v myapp-signed.exeOr right-click → Properties → Digital Signatures. Check both the signature and the timestamp counter-signature.
Step-by-step setup: Code Signing Setup · CI recipes: Code Signing in CI/CD
Related: Shipping a ClickOnce application instead? That one has its own quirks: code signing for Visual Studio ClickOnce deployments.