Signing a Windows EXE file

You can try using Microsoft's Sign Tool

You download it as part of the Windows SDK for Windows Server 2008 and .NET 3.5. Once downloaded you can use it from the command line like so:

signtool sign /a MyFile.exe

This signs a single executable, using the "best certificate" available. (If you have no certificate, it will show a SignTool error message.)

Or you can try:

signtool signwizard

This will launch a wizard that will walk you through signing your application. (This option is not available after Windows SDK 7.0.)

If you'd like to get a hold of certificate that you can use to test your process of signing the executable you can use the .NET tool Makecert.

Certificate Creation Tool (Makecert.exe)

Once you've created your own certificate and have used it to sign your executable, you'll need to manually add it as a Trusted Root CA for your machine in order for UAC to tell the user running it that it's from a trusted source. Important. Installing a certificate as ROOT CA will endanger your users privacy. Look what happened with DELL. You can find more information for accomplishing this both in code and through Windows in:

• Stack Overflow question Install certificates in to the Windows Local user certificate store in C#

• Installing a Self-Signed Certificate as a Trusted Root CA in Windows Vista

Hopefully that provides some more information for anyone attempting to do this!

The ASP's magazine ASPects has a detailed description on how to sign code (You have to be a member to read the article). You can download it through http://www.asp-shareware.org/

Here's link to a description how you can make your own test certificate.

This might also be interesting.

This is not a direct answer to the question, but it is closely related (and useful I hope) since sooner or later any individual programmer will have put his hand into the wallet.

So, prices for EV (Extended Validation) Code Signing Certificates, sorted by price:

AboutSSL
$240/Year (clickbait price)
$287/Year (real price, after coupon)

KSoftware.net
1 Year $350 + ($50 hidden fee!)
2 Year $600
3 Year $750

OV: $84 per year (for 3 years)

I purchased from them an EV. Some years later I purchased an OV. The eToken was sent on a USB stick. No reader needed. They are only intermediary. In the end, you actually purchase from Comodo (Sectigo). Sectigo is veeeeerrry slow. The second time, the verification took two full months. The phone verification failed multiple times. Everything was cumbersome. The tech support didn't have a clue about what is going on, probably just a guy in Pakistan reading through some script.

Sklep.certum.pl
1 Year 379 euro
(seems to be for Poland users only)

LeaderSsl.de
1 Year 364 euro or 307 euro (+19%VAT)
(OV 69+VAT)

Sectigo.com
1 Year $499 USD
3 Year $897 USD

GlobalSign.com
1 Year $410 total
2 Years $760 total
3 Years $950 total

Digicert.com
1 Year: $600 (it was $104)
3 Year: ?

symantec.com
1 Year: $700
3 Years: ridiculous expensive

More prices here:
cheapsslsecurity.com CodeSigning EV
cheapsslsecurity.com SSL only!

EV vs OV

With EV, nine additional steps are required including verifying a businesses’ public phone number, length of time in business, registration number and jurisdiction, as well as a domain fraud check, contact blacklist check and a telephone call to authenticate the employment status of the requestor.

Some recommend submitting a program signed with OV to Microsoft to be checked with their antivirus.

IF YOU FIND CHEAPER PRICES, let me know, and I will update the list!

How to use the certificate?

To sign the exe file, I used MS signtool.exe. For this you will need to download the bloated MS Windows SDK which has a whooping 1GB. FORTUNATELY, you don't have to install it. Just open the ISO and extract "Windows SDK Signing Tools-x86_en-us.msi". It has a merely 400 KB.

Then I built this tiny script file:

prompt $
echo off
cls

copy "my.exe" "my.bak.exe"

"c:\Program Files (x86)\Windows Kits\10\bin\10.0.22000.0\x64\signtool.exe" sign /fd SHA256 /f MyCertificate.pfx /p MyPassword My.exe

pause 

__

What happened after signing my EXE file?

So, after investing some money, I finally signed my EXE file. What happened after that? Nothing... On Win10 I still see the same "untrusted" window with the "Don't run" button. The "Continue" button is still invisible. My program has about 400 downloads per day. Let's wait and see how many downloads are necessary.

Reference https://steward-fu.github.io/website/driver/wdm/self_sign.htm Note: signtool.exe from Microsoft SDK

1.First time (to make private cert)

Makecert -r -pe -ss YourName YourName.cer

certmgr.exe -add YourName.cer -s -r localMachine root

2.After (to add your sign to your app)

signtool sign /s YourName YourApp.exe