Windows Authenticode Code Signing

Windows Authenticode Code Signing Pipeline

Eliminate Windows SmartScreen "Unknown Publisher" warnings by signing your desktop executables with local PFX certificates or Hardware EV Tokens.

---

🛡️ Why Code Signing Matters

When users download and launch an unsigned .exe on modern Windows 10 and 11, Windows Defender SmartScreen displays a prominent blue barrier:

┌───────────────────────────────────────────────────────────┐
│  Windows protected your PC                                │
│  Microsoft Defender SmartScreen prevented an unrecognized │
│  app from starting. Running this app might put your PC    │
│  at risk.                                                 │
│                                                           │
│  App:      MyApplication.exe                              │
│  Publisher: Unknown publisher                             │
│                                                           │
│                  [ Don't run ]                            │
└───────────────────────────────────────────────────────────┘

Signing your executable with a valid Authenticode Digital Certificate attaches cryptographic proof of your identity, builds positive SmartScreen reputation, and displays your verified company or developer name.

---

⚙️ Configuration in Tab 4 (Security & Signing)

WebToApp Studio Pro provides a unified code signing workbench supporting both Standard (OV) and Extended Validation (EV) certificates:

1. Local PFX / P12 File Mode (Standard OV)

• Certificate Path: Select your .pfx or .p12 certificate file.
• Password Vault: Enter your private key password.
• Encrypted Project Storage: Passwords saved in .wtp project configuration files are encrypted using AES-256 with Windows DPAPI machine keys, preventing plaintext credential leaks into version control.

2. Windows Certificate Store Mode (Hardware EV Tokens)

Modern Extended Validation (EV) certificates are stored on hardware security modules (HSM tokens like SafeNet eToken or YubiKey FIPS) and cannot be exported to PFX files.

• Target via SHA-1 Thumbprint: Enter your certificate's 40-character SHA-1 thumbprint (hexadecimal).
• Automatic Hardware Pin Prompt: WebToApp Studio links with the Windows Certificate Store; Windows prompts for your physical token PIN when signing begins.

3. RFC 3161 Trusted Timestamping

Always keep timestamping enabled. This ensures your signature remains cryptographically valid even after your certificate expires!

• Default Timestamp URL: http://timestamp.digicert.com (or Sectigo: http://timestamp.sectigo.com).
• Digest Algorithm: SHA-256 (SHA-1 is deprecated by Microsoft and rejected by modern Windows).

---

🔄 1-Click In-Place Retry Signing

If an initial build finishes with an invalid password, disconnected USB token, or temporary timestamp server network timeout:

• A non-blocking amber warning appears in the post-build modal.
• Click "Retry Signing": Re-enter your password or reconnect your token.
• Re-signs the exported executable in-place in under 2 seconds without requiring a complete project re-export!

---

🔍 Verifying Signatures via PowerShell

To verify that an exported binary is properly signed and timestamped:

Get-AuthenticodeSignature -FilePath "dist/MyApplication.exe" | Format-List

Expected output:

SignerCertificate      : [CN=Your Company / Developer Name]
TimeStamperCertificate : [CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA]
Status                 : Valid
StatusMessage          : Signature verified.