Windows Smart Screen and Code Signing

by: Anthony Garland
Follow @AnthonyPGarland

While developing Graderworks, I ran into an issue with Windows Smart Screen filter. When users would download and run the installer, it would pop up with this message.

Naturally, this discouraged customers from using the free 30 day trial of Graderworks. If I were a client, I would likely not install the software either. 

Unfortunately, there is not a good solution. All you can do is have your installer signed with a digital code certificate. You can see in the image that my installer is signed, but it is still being flagged as dangerous. Even with this certificate, the smart screen filter did not go away for almost two weeks. Although Microsoft gives information on how to sign an application, I found their tutorial only moderately helpful. 

These are the steps I followed to get my installer signed.

1. I used cheapsslsecurity.com generate a code signing certificate. 
   • The certificate is actually from Comodo but sold through cheepsslsecurity.com
   • It cost me $85 for a 1-year certificate
   • I had to make a YellowPages listing for my business with a valid phone number (this was required by Comodo). 
   • I had to send Comodo information about my business from the SC secretary of state (i.e., my LLC articles of organization). You can make an LLC pretty quickly at SC Business One Stop.
   • Comodo called me to verify my phone number. (Basically, Comodo wants to prove that I'm a real person that can be sued if I start distributing malware.)
   • I downloaded my certificate using Firefox (don't use Google Chrome, it won't' work). 
2. I installed the Windows 10 SDK 
3. I added C:\Program Files (x86)\Windows Kits\10\bin\x86 to the windows system environmental PATH variable
4. Then, using Powershell, I ran this command, and it worked!

>> signtool.exe sign /f comodocodsigningkeycertificate.pfx /p secretpassword Graderworks2.0.exe

My critique of Microsoft is 1. The steps needed to sign my certificate were not clear. It was not clear at all that I needed to install the Windows SDK and add the kit\bin folder to the PATH variable. Also, it was not clear that signing my installer would not result in the smart screen filter being immediately removed. 2. The 'reputation' system used by the smart screen filter makes some sense, but more transparency would be helpful. In the end, it hurts small business who have just released a new application and have no 'reputation'.