Authenticode of exe files is still using SHA1 signing
Created originally on Bitbucket by Anonymous
Hi Steve,
from the beginning of this year exe files have to be signed using sha-256 instead of sha1. Otherwise SmartScreen might block those signed exe files. I was in the same situation and searched the internet.
If you are using signtool the arguments look like this: signtool sign /f ".pfx" /fd SHA256 /td sha256 /p /d "your name" /du "your url" -tr http://timestamp.geotrust.com "your file"
To make the certificate also valid on XP lower than SP3 you also have to sign your app using SHA1. This can be done using /as to add additional certificates:
signtool sign /as /f ".pfx" /p /d "your name" /du "your url" -tr http://timestamp.geotrust.com "your file"
More information can be found on this page: http://social.technet.microsoft.com/wiki/contents/articles/32288.windows-enforcement-of-authenticode-code-signing-and-timestamping.aspx
Regards