Get rid of "Publisher Unverified" warnings in Windows for executables

Question

I have made an application for Windows & everytime I run the application by opening the executable file I get the "Publisher Unverified" warning in Windows. It is fine if I was the only audience for this app but thats not the case. Is there any way to program my app such that this message does not show up for the users.

Answer 1

The only way to do this is to obtain and use a code signing certificate from a trusted source. Microsoft calls this Authenticode.

Unfortunately for the little guy, these cost. Verisign sells theirs for about four hundie a year.

Here are some starting points you should read about Authenticode:

http://msdn.microsoft.com/en-us/library/ms537359%28VS.85%29.aspx
http://technet.microsoft.com/en-us/library/cc750035.aspx
http://msdn.microsoft.com/en-us/library/aa379872%28VS.85%29.aspx

Some certificate dealers:

http://www.verisign.com
http://www.thawte.com
http://www.globalsign.net
http://www.geotrust.com

Answer 2

For a cheaper code signing certificate, you can use Comodo. There is a reseller called KSoftware which sells their certificates for $99/yr:

http://www.ksoftware.net/code_signing.html

I used them a few years ago and had no problems.

You can then use SignTool from the .net SDK to sign your EXE files. There is a tutorial here:

http://www.tech-pro.net/code-signing-for-developers.html

Answer 3

I think there is a way to resolve this. We need to add digital signature to the executables. The way to add digital signatures is very nicely outlined at,

• http://blog.didierstevens.com/2008/12/30/howto-make-your-own-cert-with-openssl/
• http://blog.didierstevens.com/2008/12/31/howto-add-a-digital-signature-to-executables/

Basically we will use OpenSSL to create our own digital signatures and then use the SignTool application by Microsoft to add it to our executable.