Code Signing for Windows: what changed
Revision 3 to 4. Removed lines have a minus sign; added lines have a plus sign.
| Old | New | Line | |
|---|---|---|---|
| 1 | + | [](</File:Windows_logo_-_2012.svg>) | |
| 2 | + | ||
| 3 | + | This article applies to [Windows](</Category:Windows> "Category:Windows") only. | |
| 4 | + | ||
| 5 | + | See also: [[Multiplatform Programming Guide]] | |
| 6 | + | ||
| 7 | + | │ **English (en)** │ | |
| 8 | + | ||
| 9 | + | ||
| 10 | + | ||
| 1 | 11 | ## Description of the problem | |
| 2 | 12 | ||
| 3 | 13 | **Question:** | |
| 4 | 14 | ||
| 5 | - | ||
| 15 | + | I notice Windows 10 gives me a warning that the publisher is unknown after unzipping and attempting to run an executable. | |
| 6 | 16 | ||
| 7 | - | ||
| 17 | + | Has anyone ever "registered" and if so what authority did they register with, what was the experience like (slow/fast), cost etc? | |
| 8 | 18 | ||
| 9 | - | ||
| 19 | + | **Answer** from forum member Dmitry "skalogryz" Boyarintsev: | |
| 10 | 20 | ||
| 11 | - | ||
| 21 | + | In order to have the application launch without any "questions", you'll need to purchase an EV certificate. It costs up to $US 500 (prices vary, but I doubt you can find anything below $US 250). The approval might take about a week, since they will do the verification of your actual existence (the existence of your company). If they are prompt enough they might get you verified in a matter of a day or two. For me it took about three weeks. | |
| 12 | 22 | ||
| 13 | - | ||
| 23 | + | Note that EV certificates are usually "hardware" generated. Meaning you'll have some sort of hardware device in order to sign an executable. The hardware device also needs to be mailed to you... which adds the time to the point when you can finally sign an executable. | |
| 14 | 24 | ||
| 15 | - | ||
| 25 | + | You can get a simple certificate, but it will still show "Running application by ... Name of your company". Simple certificates are cheaper, about $100. | |
| 16 | 26 | ||
| 17 | - | ||
| 27 | + | Keep in mind that certificates expire and must be renewed - usually for the same price, or a bit more expensive if you used some promo when buying the first certificate. The renewal process is as fast as simply paying for it, but if you miss the renewal date, you might have to pass the approval process again. | |
| 18 | 28 | ||
| 19 | - | ||
| 29 | + | You can't use your HTTPS web site certificate. Your HTTPS certificate was given for a domain name, not an executable. However, the same authority that issued your HTTPS certificate might also be providing code signing certificates (and you might be eligible for a discount of some sort). | |
| 20 | 30 | ||
| 21 | - | ||
| 31 | + | You also cannot use a developer certificate issued by Apple for [[Code Signing for macOS|code signing macOS applications]]. | |
| 22 | 32 | ||
| 23 | 33 | ## Examples of certificate companies | |
| 24 | 34 | ||
| 25 | - | ||
| 26 | - | ||
| 27 | - | ||
| 28 | - | ||
| 29 | - | ||
| 30 | - | ||
| 31 | - | ||
| 35 | + | * [SSL2BUY](<https://www.ssl2buy.com/code-signing-certificate>). "OV Code Signing Certificate". $60 per year. | |
| 36 | + | * [Comodo EV](<https://comodosslstore.com/code-signing/comodo-ev-code-signing-certificate?gclid=CjwKCAjwndCKBhAkEiwAgSDKQfX5LQgnCeJ6VF95YAZ0FDIVSmosUBtDvhVyrqX5STHNvyJNk0JMuxoCEb8QAvD_BwE>). $US 399 per year for EV certificate, without a promotion. | |
| 37 | + | * [Digicert](<https://www.digicert.com/order/order-1.php>). $US 699 per year for EV certificate. | |
| 38 | + | * [KSoftware](<https://www.ksoftware.net/code-signing-certificates/>). "OV Code Signing Certificate". 80 Euros per year. | |
| 39 | + | * [Certera](<https://certera.com/code-signing>) Authentic Code Signing Certificates starting at just $199.99/year | |
| 40 | + | * [CheapSSLWeb](<https://cheapsslweb.com/code-signing>) Just $49.99/yr for OV Code Signing Certificate and just $199.99/yr for an EV Code Signing Certificate. | |
| 32 | 41 | ||
| 33 | 42 | ## Signtool: code signing tool | |
| 34 | 43 | ||
| 35 | - | ||
| 36 | - | ||
| 37 | - | ||
| 38 | - | ||
| 44 | + | Signtool comes as a part of Windows 10 SDK. The binary is typically installed at: | |
| 39 | 45 | ``` | |
| 40 | - | ||
| 41 | - | ||
| 46 | + | C:\Program Files (x86)\Windows Kits\10\bin\__version__\x64 | |
| 47 | + | ``` | |
| 42 | 48 | ||
| 43 | - | ||
| 49 | + | 1\. Install (or generate the certificate) into Windows Certificate Center. EV certificates should also be installed, but signing them requires the hardware key to be present at the time of signing | |
| 44 | 50 | ||
| 45 | - | ||
| 51 | + | 2\. Very basic sign command line: | |
| 52 | + | ``` | |
| 46 | 53 | signtool sign project1.exe | |
| 47 | 54 | ``` | |
| 48 | 55 | ||
| 49 | 56 | ## See also | |
| 50 | 57 | ||
| 51 | - | ||
| 58 | + | * [[Code signing]] | |
| 52 | 59 | ||
| 53 | 60 | ## External links | |
| 54 | 61 | ||
| 55 | - | ||
| 56 | - | ||
| 62 | + | * [Microsoft: official documentation for signtool](<https://docs.microsoft.com/en-us/windows/win32/seccrypto/signtool>) | |
| 63 | + | * [Microsoft: Windows 10 SDK download page](<https://developer.microsoft.com/en-us/windows/downloads/windows-10-sdk/>) | |
| 57 | 64 | ||
| 58 | 65 | --- | |
| 59 | - | ||
| 66 | + | *From the Free Pascal wiki, page "Code Signing for Windows", as the Internet Archive kept it on 2024-09-13, last changed on 2024-05-28. Copyright stays with the author who wrote it, according to the old wiki's [[Licensing]] page. If you have concerns about this material, [message the admin](/wiki-contact).* |