How to Sign a Windows Application (SignTool, Timestamping, SmartScreen)

Here is how to sign a Windows application in short: connect the hardware token (or cloud signing service) that holds your code signing key, run Microsoft SignTool with a SHA-256 file digest and an RFC 3161 timestamp server, then verify the result. The whole process takes one command per file once your certificate is set up.

Signing attaches your verified publisher name to the file and proves that nobody changed it after you built it. Windows shows that name in the User Account Control prompt instead of “Unknown publisher.” If you do not have a certificate yet, compare code signing certificates first; this guide starts after delivery.

What you need	Where it comes from
Code signing certificate (OV or EV)	Issued by DigiCert or Sectigo after validation
Private key on certified hardware	USB token, your HSM or the CA’s cloud signing service
SignTool.exe	Included in the Windows SDK
Timestamp server URL	Provided by your CA, for example DigiCert’s
The files to sign	.exe, .dll, .msi, .cab or script files from your build

How do I sign an .exe with SignTool?

Run signtool sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /a "MyApp.exe". This signs the file with SHA-256, adds a timestamp from DigiCert’s server and lets SignTool pick the best matching certificate automatically.

signtool sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /a "C:\build\MyApp.exe"

If you have more than one certificate installed, select the right one explicitly. Use /n "Your Company Inc." to select by subject name, or /sha1 <thumbprint> to select by certificate thumbprint (remove the spaces from the thumbprint).

signtool sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /sha1 0123456789ABCDEF0123456789ABCDEF01234567 "C:\build\MyApp.exe"
signtool verify /pa /v "C:\build\MyApp.exe"

What each option does:

• /fd sha256 – file digest algorithm (the hash of your file).
• /tr URL – RFC 3161 timestamp server; use the URL your CA provides.
• /td sha256 – digest algorithm for the timestamp request.
• /a, /n or /sha1 – how SignTool picks the certificate.
• verify /pa – checks the file with the default Authenticode policy.

Cloud signing services usually work through a plugin or key storage provider that SignTool calls. The command looks almost the same; follow your CA’s setup guide for the extra parameters.

Why does SmartScreen still warn after signing?

Because Microsoft Defender SmartScreen also looks at reputation, not only at the signature. A new certificate or a new file starts with little reputation, and the warning fades as clean downloads build up over time.

SmartScreen checks two signals: publisher reputation (tied to your signing certificate) and file reputation (tied to the file’s hash). Microsoft gives no exact threshold. Its documentation says reputation builds organically through download volume and can take several weeks.

As of October 2026, an EV certificate no longer skips this process. Microsoft’s documentation states that EV-signed files stopped bypassing SmartScreen in 2024 and now build reputation the same way as OV-signed files. EV still means stricter identity validation, which some enterprise buyers ask for.

Tip: Sign every release with the same certificate identity and always timestamp. Changing your publisher identity affects the publisher trust signal, so avoid switching names between releases.

Can I sign MSI and PowerShell scripts too?

Yes. SignTool signs Windows Installer (.msi) packages, .dll and .cab files with the same command as an .exe. PowerShell scripts are signed with the Set-AuthenticodeSignature cmdlet, which adds a signature block at the end of the script.

File type	Tool	Note
.exe, .dll	SignTool	Sign every binary you ship, not just the installer
.msi, .cab	SignTool	Sign the files inside before you build the package, then sign the package
.ps1 PowerShell scripts	Set-AuthenticodeSignature	Use -TimestampServer with an http:// URL and -HashAlgorithm SHA256
MSIX / APPX packages	SignTool	The package publisher must match the certificate subject

Set-AuthenticodeSignature -FilePath .\Deploy.ps1 -Certificate (Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert) -HashAlgorithm SHA256 -TimestampServer "http://timestamp.digicert.com"

Office macros, Java and other platforms use their own tools; this page sticks to Windows.

Signing in your build pipeline

Make signing a fixed step in your release process, not a manual task at the end. That way every file you ship is signed the same way, with the same identity and a timestamp.

1. Build your binaries in release mode.
2. Sign every executable and library (.exe, .dll) that ends up on the user’s machine.
3. Package the signed files into your installer (.msi or setup .exe).
4. Sign the installer itself, with a timestamp.
5. Verify all signed files with signtool verify /pa before you publish.

Two optional SignTool options are worth adding: /d "Product name" sets a description and /du https://your-site.example adds a URL to the signature details. Keep the token, HSM or cloud signing credentials out of your source code and give build agents only the access they need.

Common SignTool errors and fixes

Error	Likely cause	Fix
No certificates were found that met all the given criteria	Token not connected, driver missing or wrong /n or /sha1 value	Reconnect the token, check certmgr.msc, copy the thumbprint again
The specified timestamp server either could not be reached or returned an invalid response	Firewall, proxy or wrong URL	Allow outbound HTTP to the timestamp server and retry
Verify reports an untrusted root	Missing intermediate certificate or wrong verify policy	Install the CA’s intermediate certificate and use verify /pa
PIN prompt blocks the build	Token client asks for the PIN interactively	Check your token client’s settings or move to cloud signing

Where and how your key is stored decides how well signing fits into automated builds. See our overview of code signing key storage requirements for tokens, HSMs and cloud signing. To understand why a website certificate cannot sign software, read code signing vs SSL.