Code Signing for Windows 7, 8 and 10

Feb 29, 2024

Code Signing for Windows 7, 8 and 10


This article will be the default article after the implementation of
the new Minimum Requirements for Code Signing on February 1, 2017.


  • GlobalSign Code Signing Certificate Downloaded & Installed onto a hardware token.
  • Windows Software Development Kit (SDK) For Windows 8.1
  • SHA-256 orders additionally use the R1-R3 Cross Certificate – default March 31, 2014 & after. (The R1-R3 Cross Certificate will need to be installed on the signing computer but not specified as an additional certificate during the signing procedure)

Important SignTool Options

  • /ac  -  Specify an Additional Certificate.
  • /a  -  Automatically selects the best certificate to sign the file from your  Windows Certificate Store.
  • /n "Certificate Common Name" Specifies the certificate to sign the file from your Windows Certificate Store using the certificate common name.
  • /fd SHA256  -  Specify the file digest algorithm used in creating file signatures.
  • /t  -  Specify a Microsoft Authenticode compatible time stamp server.
  • /tr  -  Specify an RFC 3161 compliant trusted time stamp server.*Recommended*
  • /td SHA256  -  Must be called after "/tr", this command specifies the TimeStamp digest Algorithm. *Recommended*                     

Note: Timestamping your Code is extremely important and is highly recommended for every piece of code that you sign. 
This timestamp will allow the file that you sign to remain valid long after the certificate itself has expired.

TimeStamp URLs:
SHA-2 based:


  1. You can either sign files out of a working directory, or you can place them in your Windows SDK\bin folder.
  2. Open the Command Prompt: Windows 7: Start > Run > cmd, or for Windows 8 - 10, press the Windows Key, then type cmd and press enter.
  3. Navigate to the directory with signtool.exe.
  4. Use the following command to sign your file: 
    signtool sign /a /tr /td SHA256 /fd SHA256 c:/path/to/your/file.exe
  5. Enter your Token Password. If the signing is successful you will see a prompt informing you so.
  6. To verify the successful signature use the following commands:
    Authenticode: signtool verify /v /pa
    Kernel Driver Signing: signtool verify /v /kp

 You may also verify the signature within the properties of the file, under the Digital Signatures tab.

Related Articles

GlobalSign System Alerts

View recent system alerts.

View Alerts

Atlas Discovery

Scan your endpoints to locate all of your Certificates.

Sign Up

SSL Configuration Test

Check your certificate installation for SSL issues and vulnerabilities.

Contact Support