Signing a Windows exe file

Question

I have an exe file that I should like to sign so that Windows will not warn the end user about an app from an "unknown publisher". I am not a Windows developer, the app in question is a screensaver app generated from an app that generates screensaver apps. As such I have no influence on how the file is generated.

I've already found out that I wll need a code signing certificate from a CA like VeriSign or instantssl.com. What I don't understand is what I need to do (if at all possible) to sign my exe file. A simple explanation for slow people like me would be greatly appreciated. Thanks!

Update: Mel Green's answer took me further, but signtool wants me to specify what cert to use in any case. Two questions:

1. Can I get a free code signing certificate somehow to test if this will work for me at all?

2. Do you have a cheap-ish source for the appropriate SSL certificate? The cheapest I've been able to find is this product from instantssl.com which is about $179 per year. Are there any offerings for around $100 out there?
   Also please specify which certificate kind is the correct one. Most sites only mention "code signing" and talk about signing applications that are actually compiled by the user. This is not the case for me.

Again, thanks a lot for your ideas!

Answer 1

You can try using Microsoft's Sign Tool:

http://msdn.microsoft.com/en-us/library/aa387764.aspx

You download it as part of the Windows SDK for Windows Server 2008 and .Net 3.5. Once downloaded you can use it from the command line like so:

signtool sign /a MyFile.exe

This signs a single executable. Not sure what certificate it uses.

Or you can try:

signtool signwizard

This will launch a wizard that will walk you through signing your application.

Answer 2

You can get a cheap code-signing certificate through https://author.tucows.com/

• Comodo Code Signing Certificate - 1 yr.: $75
• Comodo Code Signing Certificate - 2 yr.: $140
• Comodo Code Signing Certificate - 3 yr.: $195

Also, the ASP's magazine ASPects has a detailed description on how to sign code (You can to be a member to read the article). You can download it through http://www.asp-shareware.org/

Here's link to a description how you can make your own test certificate.

This might also be interesting.