Authenticode Digital Signatures - Step By Step Guide

Step 1 - Obtain your Code Signing Certificate

There are a number of certificate issuing authorities. We recommend Thawte for the best combination of value and wide Operating System compatibility. (If you choose to use a certificate from another provider make sure you check which Operating Systems they support, ask which Operating Systems their "root certificate" is installed in).

To obtain your certificate click on the Thawte logo above. The certificate type you need is the Code Signing Certificate, and on the second page of the order process you need to select the Microsoft Authenticode (Multi-Purpose) Certificate option.

Step 2 - Download and install the Code Signing Tool.

The code signing tool comes from Microsoft, and is known as signcode.exe. It is free.

Go to the Microsoft Download Center at http://www.microsoft.com/downloads and enter the keyword Authenticode into the search keyword box. The results should include "Authenticode for Internet Explorer x.x.....". Select that, then from the resultant page download the codesigningx86.exe file and run it (it is in fact a self-extracting zip file). Unzip it to somewhere appropriate on your system and 8 executable files will appear. You only need one of them, the file called signcode.exe. This file must be placed somewhere in your Path so that the WebCompiler Project Manager can launch it. The simplest way to achieve this is to copy the signcode.exe file to your Windows directory.

Step 3 - Set the WebCompiler Project Options appropriately.

When you purchased the Code Signing Certificate you received two files, a Certificate File and a Private Key File. Store these on your hard drive somewhere and tell the WebCompiler Project Manager where they are, then specify the Timestamp Server you want to use (the default Verisign server is fine) and set the Digitally Sign after Compilation option to Yes. The options will then look something like this...

Step 4 - Compile your Presentation

At the end of the compilation phase WebCompiler will launch the signcode.exe code signing tool to sign your presentation. You will see a dialog requesting your password (which you will have selected when you purchased your Code Signing Certificate). After entering the password there may be a second or two delay while the Timestamp Server is accessed to timestamp your code and the process will then be complete.

Step 5 - Check the Digital Signature

To check that your presentation has been correctly signed simply right-click on the presentation executable and select the Properties option, and then select the Digital Signatures tab on the resulting dialog box. You might also want to upload the file to a web server somewhere and then download and try to run it on Windows XP with Service Pack 2 to be sure that the "Unsigned Publisher" warning message does not appear.