How to Code Sign Your EXE File (Digital Signature)

When you digitally sign your standalone workbook EXE file, you assure end-users that the file is authentic and has not been tampered with. This process, also known as code signing, uses Microsoft Authenticode® technology to verify that the code originates from a trusted publisher.

XLS Padlock simplifies the code signing process by handling the necessary steps internally.

To sign your application, you need a valid Code Signing Certificate from a trusted Certificate Authority (CA) like Sectigo or Digicert. Other certificate types, like SSL/TLS, are not compatible.

As of June 1, 2023, all new code signing certificate private keys must be stored on secure hardware, such as a FIPS 140-2 Level 2 compliant USB token or Hardware Security Module (HSM). This enhances security by preventing key theft. XLS Padlock works seamlessly with token-based certificates; just ensure the token is plugged into your computer when you build your application.

In the XLS Padlock interface, navigate to the Security -> EXE Code Signing tab. To enable signing, choose your preferred Code Signing Method:

• PFX File: Uses a certificate stored in a .pfx file. This is a legacy method for older certificates.

• Certificate Subject Name: Locates the certificate in the Windows Certificate Store by its Subject Name. This is a common method for certificates on hardware tokens.

• Certificate Thumbprint: Locates the certificate in the Windows Certificate Store by its unique Thumbprint (a SHA-1 hash). This is often the most reliable method.

• SignTool Commands: An advanced method that allows you to provide custom commands for Microsoft’s SignTool.exe utility, offering maximum flexibility.

• Azure Trusted Signing: Signs your application with Microsoft’s cloud-based service. See our Azure Trusted Signing Tutorial for more details.

  Azure CLI Required

  To use this method, you must first install the Microsoft Azure CLI and log in using az login.

• Manual Signing: Click Sign EXE File Now to immediately sign the last built EXE file.
• Automatic Signing: Check Automatically sign my EXE file to have XLS Padlock sign the EXE every time you build your application.