Distributing a Windows application without code signing guarantees trouble with SmartScreen and Windows Defender. Even if the app is completely safe, users see an 'Unknown Publisher' warning — and in 30% of cases, they abandon the installation. For commercial products, each lost installer means missed revenue. According to Microsoft, signed applications are blocked less often. An app signed with an EV certificate removes all warnings; an OV certificate builds reputation over time. We configure the build and signing process so that installation proceeds without extra dialogs, making your product look professional. The certificate cost runs a few hundred dollars per year but pays off through user trust.
How to Configure a Desktop Application Build for Windows
Electron + electron-builder is the most common stack for cross-platform applications. It lets you create installers for Windows, macOS, and Linux from a single codebase. A typical configuration looks like this:
# electron-builder.yml appId: com.company.appname productName: AppName win: target: - target: nsis # standard installer - target: zip # portable version icon: build/icon.ico sign: true nsis: oneClick: false perMachine: true allowToChangeInstallationDirectory: true WiX Toolset is used for creating MSI packages required in enterprise environments with SCCM/Intune. MSI enables centralized installation and updates. A simple .wxs example:
<!-- product.wxs --> <Product Id="*" Name="AppName" Version="1.0.0" Manufacturer="Company"> <Package Compressed="yes" /> <Directory Id="TARGETDIR" Name="SourceDir"> <Directory Id="ProgramFilesFolder"> <Directory Id="INSTALLFOLDER" Name="AppName" /> </Directory> </Directory> <Component Id="MainExecutable" Directory="INSTALLFOLDER"> <File Source="AppName.exe" KeyPath="yes" /> </Component> </Product> How to Choose an Installer Type
| Installer | Advantages | Disadvantages | Best for |
|---|---|---|---|
| NSIS | Easy to configure, small size, scriptable | Limited enterprise support | Small to medium projects, quick start |
| MSI (WiX) | SCCM/Intune integration, group policy, rollback | Complex configuration, larger size | Large enterprises, corporate distribution |
Your choice depends on your target audience. If your product is enterprise-oriented, go with MSI. For mass users, NSIS is sufficient.
Why Code Signing Is Mandatory
SmartScreen analyzes the digital signature and publisher reputation. Without a signature, the reputation is zero, and the system blocks installation. A signed app with an EV certificate gets immediate 'green light'. We help you choose the right certificate type and configure the process.
| Certificate Type | Acquisition Time | SmartScreen Trust | Cost (approx.) |
|---|---|---|---|
| EV (Extended Validation) | 3–7 days | Immediate, no warnings | Higher |
| OV (Organization Validation) | 1–3 days | Requires reputation building | Lower |
EV is better than OV: it provides seamless installation immediately, while OV needs time to build reputation. For most commercial products, we recommend EV.
Code Signing Procedure
Signing is performed using signtool.exe from the Windows SDK. Example:
# Signing via signtool.exe signtool sign ` /fd SHA256 ` /tr http://timestamp.digicert.com ` /td SHA256 ` /f certificate.pfx ` /p $env:CERT_PASSWORD ` "dist\AppName-Setup.exe" # Verify signature signtool verify /pa "dist\AppName-Setup.exe" Automated Signing in CI/CD (GitHub Actions)
- name: Sign Windows executable env: CERTIFICATE_BASE64: ${{ secrets.WINDOWS_CERTIFICATE_BASE64 }} CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }} run: | $cert = [Convert]::FromBase64String($env:CERTIFICATE_BASE64) [IO.File]::WriteAllBytes("certificate.pfx", $cert) & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\signtool.exe" ` sign /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 ` /f certificate.pfx /p $env:CERTIFICATE_PASSWORD ` "dist\AppName-Setup.exe" Auto-Update
Signing the installer is just the first step; delivering updates is equally important. electron-updater supports GitHub Releases, S3, and custom update servers. Updates download in the background, and the user gets a notification to restart at their convenience — no forced interruption. For MSI distributives, we use Windows Installer patch or a full re-built package with the new version. The update package must also be signed — otherwise SmartScreen will block installation of the patch. Delta updates reduce download size by 60-70%, critical for users with slow connections. We set up a channel system: stable, beta, nightly — each channel gets its own update branch and separate signing key.
What the Work Includes
- Audit of your current build process — identify bottlenecks and suboptimal configurations.
- Choice of installer type and certificate — based on your target audience.
- Configuration of build scripts — set up electron-builder or WiX for automatic signing.
- Integration of signing into CI/CD — configure GitHub Actions, GitLab CI, or Jenkins to sign every release securely.
- Installation testing — verify that the app installs without warnings.
- Delivery of documentation — describe the process and provide recommendations for certificate renewal.
We handle everything turnkey in 2–3 working days. Our team has 5 years of experience in desktop application packaging and over 50 successful projects. Contact us for a consultation — we'll evaluate your project and propose the optimal solution. Order build configuration so your application looks professional and inspires trust.
Additional Recommendations
- Store the certificate in a secure vault like Azure Key Vault or AWS KMS.
- Use separate certificates for dev and prod environments.
- Regularly check certificate expiration — expiry can block a release.
- Savings on user support after implementing signing can reach 20%.
For in-depth study, refer to the official documentation: signtool and WiX Toolset.