Code Signing an Application • Comprehensive Guide

Why Code Signing Matters

Code signing cryptographically proves your app’s origin and integrity. Without it, modern operating systems treat your software as untrusted, triggering warnings, blocking installations, or triggering antivirus alerts.

Windows Impact

Microsoft SmartScreen blocks unsigned apps
Users see scary “Unknown Publisher” warnings
EV certificates provide the highest trust level

macOS & Mobile Impact

Gatekeeper rejects unsigned macOS apps
iOS requires Apple notarization
Android Play Protect flags unsigned APKs

98%

of enterprise users require signed software

4×

higher install conversion rate for signed apps

Choosing the Right Certificate

OV (Organization Validation)

Verifies your organization. Sufficient for most internal or small-scale distribution.

Best for: Desktop apps, internal tools

EV (Extended Validation)

Stricter validation with hardware token or cloud HSM. Bypasses SmartScreen warnings.

Best for: Public-facing Windows software

Where to Obtain a Code Signing Certificate

Trusted Certificate Authorities (CAs) issue code signing certificates. Choose based on platform, validation level, and whether you prefer cloud signing or traditional tokens.

DigiCert

EV & OV

Industry leader for EV certificates. Offers cloud signing via DigiCert ONE.

digicert.com/code-signing →

Sectigo

EV & OV

Formerly Comodo. Affordable options with strong Windows support.

sectigo.com →

GlobalSign

EV & OV

Strong enterprise offerings and cloud HSM integration.

globalsign.com →

Entrust

EV & OV

High-security focus with hardware token and cloud options.

entrust.com →

Apple Developer Program

macOS / iOS

Direct from Apple. $99/year required for Developer ID certificates.

developer.apple.com →

Cloud Options

Azure / AWS

Microsoft Azure Code Signing and AWS Signer — no physical tokens needed.

Azure Portal • AWS Console

Recommendation: Start with DigiCert or Sectigo for Windows EV. Use Apple’s portal for macOS. Cloud signing services eliminate hardware headaches and are ideal for CI/CD pipelines.

Windows

macOS

Mobile

Windows — Authenticode Signing

Acquire your certificate

Recommended CAs: DigiCert, Sectigo, GlobalSign, or Entrust. EV certificates typically cost $400–$800/year and require identity verification.

Pro tip: Choose cloud signing (Azure Code Signing, AWS Signer) to avoid managing physical tokens.

Install & prepare

Import your .pfx into the Current User\My certificate store or use a cloud HSM. Never commit the .pfx to source control.

Sign your executable

signtool sign /n "Your Company Name" 
  /tr http://timestamp.digicert.com 
  /td SHA256 /fd SHA256 
  /a YourApp.exe

Always use SHA-256. Timestamping is mandatory for long-term validity.

Verify the signature

signtool verify /pa /v YourApp.exe

Look for “Successfully verified” and a valid timestamp.

macOS — Developer ID & Notarization

Enroll in Apple Developer Program

Cost: $99/year. Create a “Developer ID Application” certificate in the portal and download it to your Mac.

Sign the app bundle

codesign --deep --force --options runtime 
  --sign "Developer ID Application: Your Name (TEAMID)" 
  YourApp.app

The runtime flag enables hardened runtime (required for notarization).

Notarize with notarytool

xcrun notarytool submit YourApp.zip 
  --keychain-profile "AC_PASSWORD" 
  --wait

Apple’s notary service scans for malware. Once approved, staple the ticket:

xcrun stapler staple YourApp.app

iOS & Android

iOS

Xcode automatically signs your app when you select a valid distribution provisioning profile and certificate. For App Store distribution, use an App Store distribution certificate. TestFlight and App Store require notarization-like validation by Apple.

Android

Generate a keystore:

keytool -genkey -v -keystore my-release-key.jks 
  -keyalg RSA -keysize 2048 -validity 10000 
  -alias my-alias

Sign with apksigner or Android Studio’s Build → Generate Signed Bundle/APK wizard. Google Play recommends using Play App Signing (Google manages your signing key).

Best Practices & Security

Never share your private key. Treat it like a root password. Use environment variables, secret managers, or HSMs in CI/CD.

Timestamp everything — signatures remain valid after certificate expiry
Use EV for Windows when targeting consumers to avoid SmartScreen friction
Automate in CI/CD — GitHub Actions, Azure DevOps, and GitLab CI all support secure signing
Rotate certificates before expiry (set calendar reminders 60 days out)
Store certificates in HSM or cloud signing services for enterprise-grade security

CI/CD Example Snippet

# GitHub Actions example
- name: Sign Windows binary
  run: |
    signtool sign /f cert.pfx /p ${{ secrets.CERT_PASSWORD }} 
      /tr http://timestamp.digicert.com /td SHA256 
      /fd SHA256 YourApp.exe

Common Issues & Troubleshooting

“The signature is invalid”

Check timestamp server availability and ensure you’re using SHA-256. Re-sign with a valid timestamp.

SmartScreen still blocks the app

EV certificate + reputation building over time is required. Submit the app to Microsoft for reputation review.

Notarization fails on macOS

Ensure hardened runtime is enabled and all frameworks are signed with the same identity.

Frequently Asked Questions

How long does a code signing certificate last?

Most OV/EV certificates are valid for 1–3 years. Plan renewal 60–90 days before expiry.

Can I sign multiple apps with one certificate?

Yes. One certificate can sign unlimited applications across your organization.

What happens when the certificate expires?

Existing signatures remain valid if they were timestamped. New signatures require a renewed certificate.