Sign Windows installer and app executable using a certificate

[oxy86]

Currently, our Windows installer and executables are unsigned which means that before starting the installation Windows shows the user the following message:

To solve this we need (to buy *) a valid certificate to sign our executables and installer.

Once you have the certificate, you can sign any exe with:

signtool.exe sign /t http://timestamp.digicert.com /f yourCertFile.pfx app.exe

And then verify the signature with:

signtool.exe verify /pa /v app.exe

The signtool.exe is part of Windows SDK, which you can get from Microsoft, free of charge.

Inno Setup seems to support a SignTool method (https://jrsoftware.org/ishelp/index.php?topic=scriptcreating)

• https://shop.certum.eu/open-source-code-signing-code.html