Code Signing Certificate

A code signing certificate is a digital credential that a software developer or company applies for from a trusted authority. It allows a program to be electronically “signed.” The operating system — for example, Windows or macOS — checks this signature before launching the software. If it matches, the system knows: the file truly comes from this manufacturer, and no one has secretly altered it since. If it doesn’t match, a warning appears — or the software won’t even start.

Why code signing certificates are crucial for software security

Without such a signature, anyone could circulate a file under a false name. An attacker uploads a tampered version of a well-known program and claims it comes from the original manufacturer. Without signing, the operating system has no way to detect this deception.

Certificates solve this problem by securing trust through a chain. At the end of this chain stands a so-called certificate authority — a company like DigiCert or Sectigo that verifies identities before issuing a certificate. Windows and macOS recognize these authorities and inherently trust them. So anyone with a valid certificate has proven who they are.

For users, this means in practice: they don’t have to blindly trust a developer. The system handles the verification automatically. For companies that sell software, a valid certificate is no longer optional today but mandatory — without one, the product won’t even make it into many app stores.

How signing and verification work technically

The process is based on asymmetric encryption. Here, two related keys exist: a private one, known only to the developer, and a public one, which anyone can view. The developer calculates a short fingerprint — a so-called hash — from the finished program file and encrypts it with their private key. The result is the digital signature.

Whoever later installs the software reverses the process: the operating system decrypts the signature with the public key and calculates the file’s fingerprint itself once more. If both values match, two things are proven: first, the holder of the private key signed the file. Second, the file has not been changed by a single bit since then — because any change would alter the fingerprint.

The certificate itself contains the public key, the owner’s name, and an expiration date — usually one to three years. It is itself signed by the certificate authority, creating an unbroken chain of trust: from the developer through the certificate authority to the operating system.

Where you encounter code signing certificates in everyday life and in the news

Anyone who runs a downloaded file on Windows and sees the dialog “Windows protected your PC” is witnessing code signing in action directly. The message usually means: the program is unsigned or the certificate is unknown. Reputable manufacturers like Adobe, Mozilla, or Valve naturally sign their installers — their software starts without a warning.

In the news, the topic often comes up in connection with cyberattacks. If attackers get hold of a stolen certificate, they can use it to sign malware — which then appears trustworthy to the operating system at first glance. Well-known examples include the 2020 SolarWinds attack, in which attackers smuggled signed code into updates, and the 2023 3CX attack, in which a legitimately signed desktop app served as the entry point.

Code signing is also indispensable for app developers on mobile devices. Apple and Google require a valid developer certificate for all apps in the App Store and Play Store, respectively. An app without a certificate cannot be installed on an iPhone at all — the system refuses it at the system level, not merely through a warning.