Sign an .exe with signtool and a cloud certificate

Signing a Windows executable takes about fifteen minutes the first time and about five seconds every time after that. This guide covers the cloud path — a certificate whose private key lives in Certum’s HSM — because since June 2023 the CA/Browser Forum has required all code signing keys to be held on certified hardware. You cannot get a code signing certificate as a plain .pfx file any more.

What you need

• A code signing certificate, either standard or EV
• SimplySign Desktop and SimplySign Mobile, both from Certum
• signtool.exe from the Windows SDK

Install only the Windows SDK Signing Tools for Desktop Apps component if you do not otherwise need the SDK. It is a few megabytes rather than several gigabytes.

Step 1: Start a SimplySign session

Open SimplySign Desktop, enter your SimplySign email address and the six-digit code from SimplySign Mobile. The desktop application then mounts your cloud certificate as a virtual smart card. Sessions last two hours; when one expires the certificate disappears from the Windows certificate store and signing fails.

Step 2: Confirm Windows can see the certificate

certutil -user -store My

Your code signing certificate should be listed with its subject name and thumbprint. If it is not, the session is not active — go back to step 1.

Step 3: Sign

signtool sign ^
  /fd SHA256 ^
  /tr http://time.certum.pl ^
  /td SHA256 ^
  /a ^
  "C:\build\yourapp.exe"

What the flags do:

• /fd SHA256 — file digest algorithm. SHA-1 has not been acceptable for years.
• /tr — RFC 3161 timestamp server. Never sign without this.
• /td SHA256 — digest algorithm for the timestamp itself.
• /a — pick the best available signing certificate automatically. Use /sha1 <thumbprint> instead when the machine holds more than one certificate.

Step 4: Verify

signtool verify /pa /v "C:\build\yourapp.exe"

/pa uses the default authenticode policy — the same policy Windows itself applies. Check that the chain builds to a trusted root and that a timestamp is listed.

Signing installers, not just executables

Sign the payload executables before you build the installer, then sign the installer as well. Inno Setup and NSIS both support calling signtool as part of the build; Inno Setup does it through Tools → Configure Sign Tools. An installer whose inner binaries are unsigned still triggers warnings after extraction.

What this does not fix

A fresh certificate has no SmartScreen reputation. Your installer will still show “Windows protected your PC” until enough copies have been downloaded. That is a separate problem with a separate answer — see the SmartScreen guide.