Sign code - Authenticode-sign exe, dll, msi and PowerShell scripts
Sign an exe, dll, msi or PowerShell script with Authenticode and an RFC 3161 timestamp, using a code signing certificate from the Windows store, a USB token or a PFX.
Sign code Authenticode-signs programs, installers and scripts, timestamps the
signature and checks it - without signtool.exe and without installing the Windows SDK. It
uses the Authenticode support built into Windows (Set-AuthenticodeSignature in the
PowerShell every Windows ships), so it signs every format Windows signs and works with
certificates whose key lives on a USB token or an HSM.
This page is Windows-only. On the command line it is actk sign
and actk verify.
What it signs
| Kind | Extensions |
|---|---|
| Programs and libraries | exe, dll, sys, ocx, efi |
| Installers and packages | msi, msp, cab, cat |
| PowerShell | ps1, psm1, psd1, ps1xml |
| Windows Script | vbs, js, wsf |
Files of any other type are not added, with a note saying why.
Sign an exe or a script
Sign code is a guided workflow: Files, Certificate, Signing options, Review and sign and Result.
- Files - drop the files on the window or Choose files …. Several files are signed in one go. Check current signatures shows the signature each file already has.
- Certificate - Windows certificate store or PFX file.
- The store list shows every certificate Windows can sign with: Code Signing purpose and a private key, from the user's and the computer's store. A USB token's certificates appear once its driver is installed. Expired certificates cannot be selected - a signature made with them is not valid.
- A PFX file needs its password. It is checked when you continue and goes only to Windows' signing component on this machine.
- Signing options - the defaults fit almost every case:
- Add a timestamp (recommended) with DigiCert (
http://timestamp.digicert.com), Sectigo (http://timestamp.sectigo.com), GlobalSign (http://timestamp.globalsign.com/tsa/r6advanced1) or Other URL. - Advanced > Digest: SHA-256 (default), SHA-384 or SHA-512. SHA-256 is what Windows and every CA expect; change it only if a policy asks for more.
- The chain is included in the signature, without the root.
- Add a timestamp (recommended) with DigiCert (
- Review and sign - Sign files. A token or HSM may ask for its PIN in a Windows dialog.
- Result - every file is verified by Windows after signing and listed with its signature and timestamp state. The page reports success only when Windows confirms each signature.
Files are signed in place
Windows writes the signature into the file itself and replaces an existing signature. No copies are made - keep a backup if you need the unsigned version.
Why a timestamp matters
A timestamp from an RFC 3161 service proves when the file was signed. With it, the signature stays valid after the code signing certificate expires. Without it, the signature becomes invalid on the day the certificate expires. Only a hash of the signature is sent to the timestamp service, never the file.
Signature states
| State | Meaning |
|---|---|
| valid | Signed, unchanged since, and the chain is trusted on this computer. |
| signed · root not trusted | The signature is intact, but this computer does not trust the issuing root - normal for an internal CA that is not deployed here. |
| not signed | The file has no Authenticode signature. |
| modified after signing | The file changed after it was signed; the signature no longer matches. |
| error | Windows reports an error for the signature. |
| invalid | Windows does not accept the signature, and no signer could be read from it. |
Create a code signing certificate
You need a certificate with the Code Signing purpose and its private key.
- For internal use (scripts and tools that only run in your organization): create a request with the Code signing type in Create CSR, submit it to your internal CA - for example the Code Signing template of Active Directory Certificate Services - and import the issued certificate. The key stays in the Windows key store.
- For testing: create a self-signed code signing certificate in Create CSR. On the
machines that should accept the signature, import its
.crtinto Trusted Root Certification Authorities and Trusted Publishers, for example by group policy. - For software you distribute publicly: buy an OV or EV code signing certificate from a public CA. See the next section.
Public code signing certificates need a hardware key
Since June 2023 the CA/Browser Forum requires public CAs to issue code signing
certificates only for keys generated and kept on a hardware token or HSM. A key generated
in software - by this toolkit, OpenSSL or certreq - is therefore only suitable for an
internal CA and for testing; Create CSR says so for every code signing request. Public CAs
ship the token or create the key on your HSM themselves. Once its driver is installed, the
token's certificate appears in Sign code's store list like any other.
Public CAs also require at least RSA 3072 or ECDSA P-256 for code signing, and an OV or EV certificate names the organization, locality and country as registered.