Why does SmartScreen still warn me after signing with an EV certificate?

user_736247 0
Viewed 222

I recently bought an EV Code Signing Certificate from GoDaddy (they call it a Driver Signing Certificate though, but it should be equivalent to an EV certificate and they also state that the Driver Signing Certificate "Eliminates security warnings during download and installation" aka SmartScreen warnings) and signed both my EXE files and MSI installer using:

signtool.exe" sign /v /fd sha256 /td sha256 /tr http://tsa.starfieldtech.com /f Cert.pdf /p password Application.exe/Installer.msi

After downloading the installer (using Chrome/Edge) from one of our servers I still get the SmartScreen warning, however (it shows the company name, though)? EV certificates are supposed to establish instant reputation with SmartScreen, but it doesn't - why?

code-signing
1 Answers

After a chat session with GoDaddy support I now have conflicting information (in relation to the linked post in my original question):

  • GoDaddy Driver Signing Certificate is not the same as an EV Code Signing Certificate.
  • GoDaddy Driver Signing Certificate will not remove the SmartScreen warning immediately.

I assume this to be the more correct statements given that the SmartScreen warning is still shown when trying to install using our signed MSI file.

I assume it would still work given enough time for reputation to be built.

user_7362470
Related