(5 votes, average: 5.00 out of 5)Signing your code is more important than ever. CrowdStrike reports that in 2023, application security professional survey respondents indicated that 70% of critical security incidents took organizations more than 12 hours to resolve.
Knowing how to sign in Visual Studio, the second most popular integrated development environment (IDE) used by developers globally, will:
Explore how to use SignTool to sign your apps like a pro with our definitive Visual Studio code signing tutorial. You’ll never worry about tampering again.
Code signing in Visual Studio has been a powerful weapon against malicious code modifications for years, and it still is. However, the code signing process has changed in an important way to reflect the more stringent CA/B Forum’s Code Signing Certificate Baseline Requirements. As of June 2023, you must store your key in secure hardware (e.g., using a secure USB token, a hardware security module [HSM], or a compliant cloud storage method).
Fear not. Our detailed, up-to-date Visual Studio code signing tutorial will take you through the new SignTool process in a breeze.
Before we get into the nitty-gritty of how to sign Visual Studio applications with SignTool, let’s look at the tools of the trade you’ll need and the actions required to add a digital signature to your application.
Do you already have one? You’re in luck. After checking that it hasn’t expired, you can move to the next item on the list.
You don’t have a certificate yet? You’ll have to buy one. If you want to save money and think you can use a self-signed certificate, guess again. You might as well not bother signing your Windows app, as you’ll essentially get the same result.
[Button: Buy a Code Signing Certificate]
Code that’s unsigned or signed with a self-signed certificate is considered equally dangerous by all major operating systems (OSes) and browsers. Why? Because there’s no trusted root involved. Nasty warnings will display, and Windows users won’t be able to run it or install it without having to push past these scary messages:
So, keep self-signed certificates for testing purposes only. For apps that have to be released to the public. purchase a code signing certificate from a trusted CA and use that to sign your Visual Studio application. It can be a standard (OV) code signing certificate or an extended validation (EV) certificate. The main difference between the two? The EV certificate will remove all warnings because it will be automatically trusted.
Did you just receive your secure token? It’s now time to configure it. Our quick guide will take you through this one-time process. During the set-up, you’ll be asked to choose the encryption algorithm for your key. Opt for a 3072- or 4096-bit Rivest Shamir Adleman (RSA) key (whichever your token supports) to ensure Visual Studio recognizes it.
(NOTE: ECC certificates are not supported by Visual Studio at this time.)
Pro tip: When you’re not using the token to sign code, be sure to store it securely.
SignTool.exe comes embedded in both Visual Studio and Windows Software Development Kit (SDK). To verify that it’s already present on your device:
Tip: If you can’t find it, you might have installed SignTool with Visual Studio. In this case, it may be located under the following file path:
C:\Program Files (x86)\Microsoft SDKs\ClickOnce\SignTool\signtool.exe.
Still can’t find SignTool on your device? You probably haven’t installed it yet. Downloading and installing Windows SDK is the easiest way to get it.
Now, let’s move on to the core of this tutorial.
With the checklist done and dusted, it’s time to start learning how to sign your Visual Studio application’s .exe.
The first thing you’ll need to do is open your authentication client. In my case, I’m using a DigiCert code signing certificate for this example, so I’ll have to open the SafeNet Authentication Client.
To ensure your token is recognized by Visual Studio sign code tools, you must plug it in before opening the IDE.
Pro Tip: Does the target app appear under the list of recent apps, as shown in the example below? Select the related .sln file from that list to open it.
Signing your application’s .exe or .dll files won’t be enough to secure the app against the bad guys. Attackers aren’t fussy. They’ll target any other critical and/or vulnerable app file, including application manifest and deployment manifest files.
These two XML files describe the application and how it’s deployed. If an attacker manages to breach into one of them, they can easily modify the app and/or its behavior. This is why the installation will immediately stop if the manifests aren’t signed.
Is this statement still true, even if the other files (e.g., .exe) have been correctly signed? You betcha.
So, can you use the same code signing certificate to sign both manifests and executables? Yes, you can! To sign your manifests, follow our definitive guide to ClickOnce manifest signing. You see, this is the beauty of code signing certificates. They can be used to sign tons of files and code — everything from software apps and executables to drivers and PowerShell scripts.
OK, with the manifests signed, we can now start the .exe signing operations. Here, you have two options. Either you:
or,
Our favorite? The latter. The standalone PowerShell interface is usually easier to work with (i.e., re-sizable and mobile) than the small, built-in box. For instance, if you have two monitors, you can view your Visual Studio project on one monitor and PowerShell on the other.
1…2…3…Action! Here’s where you’ll notice the differences from the old code signing method that didn’t require a hardware security token.
In our example, we’re using a DigiCert standard code signing certificate and SafeNet Authentication Client:
Did it work on your end? If so, you should see a message stating that the .exe has been “Successfully signed” as shown above.
Most Visual Studio code signing tutorials stop at point four. After all, the .exe and the manifests have been signed. Mission accomplished, right? Maybe that’s true for some, but not for us. This is the ultimate code signing in Visual Studio tutorial, remember?
Want to code sign like a pro and keep the unknown publisher warning from appearing, even after the certificate used to sign the app has expired? Freeze your signature in time by adding a timestamp. Adding a timestamp ensures that your signature remains valid long after your certificate has expired.
For example, this is what it looks like for us using the DigiCert timestamp server:
You’re a pro, and pros take nothing for granted. (Not even their own work.) With PowerShell still open, enter the following script: signtool verify /pa “Path_to_Your_Setup.exe.” Click on the Enter key to check if the Visual Studio digital signature and timestamp you’ve just applied worked correctly.
Do you see something similar to what’s displayed in our screenshot? Yeah! Your Visual Studio application has just been signed and timestamped. You now have the ultimate protection against malware infection and tampering.
What are the implications for you as a developer/software publisher and for your users and customers? This is the question we’re going to answer next.
Technically speaking, the SignTool script we’ve just learned to use takes an application, file, or executable and hashes it using a cryptographic function. Then, it encrypts the outcome value (i.e., the hash digest) with the developer’s private key. This creates something of a checksum for users and their Windows operating systems, enabling them to verify that the software hasn’t been altered since it was signed.
After that, it generates a digital signature bundle that includes the following:
All of this data is appended to the application. But what are the consequences (or benefits) for your organizations and customers? Spoiler alert: you’ll both gain a great deal from it.
Profits, trust, security — these three magic words perfectly summarize some of the key benefits offered by code signing to software providers. Sign your Visual Studio applications to:
See? Told you, you would have both gained from it. This isn’t enough to start code signing in Visual Studio following what you’ve just learned in our tutorial? Explore even more amazing benefits that code signing can offer. You won’t regret it.
In February 2024, Microsoft and OpenAI published research on emerging threats in the era of artificial intelligence (AI). The study confirmed what most cybersecurity experts predicted: bad guys have added AI to their offensive arsenal, and they’re actively misusing it to boost their abusive techniques by using generative AI to create malicious scripts and codes.
Put this together with the cybercriminal’s old favorite, “low-hanging fruits” (e.g., unsigned or poorly protected apps), and you’ve got the perfect mix for an easy attack.
Using a code signing certificate issued from a publicly trusted CA to sign your Visual Studio applications with SignTool enables you to:
Do you use Azure Key Vault? Discover, in our next article, how to sign software packages with Azure Key Vault.
Email Us
+1 (727) 291-0611
Chat Now
