certificatessl-certificatecode-signingev-certificate

Are there any advantages in signing an application?


I looked recently into signing my application. The price is AT LEAST one hundred euros/dollars per year for EV (anything less than EV seems pointless anyway).

My application uses a basic installer (self-extracting WinRar) that requires no admin password. But the drawback of this is that I cannot install the app in Program Files.

The actual problem here is that you will find lots of resources that tell you how to sign your app but not so many (at all) that tell you if there is any real advantage. For example: do the regular PC users care when they install and app and Windows shows "Publisher: unknown" or they just quickly hit the OK button to have the installation process done as soon as possible? Honestly, I don't think that the user reads and cares about "unknown". That might stop him is actually the yellow color (instead of blue). enter image description here enter image description here

So, my question for those that already did code signing for their apps is: have you seen an improvement (downloads, installations, sales) after signing your app?
Should I invest any time/money/energy in this?

Update: It seems that having the app signed is not enough. After that, you have to keep fighting to improve your reputation factor, otherwise, Microsoft SmartScreen might pop-up: https://mkaz.blog/code/code-signing-a-windows-application/


For those interested in prices, here a few random offers sorted by price. I will also post the documents required: Signing a Windows EXE file



Solution

  • For those interested in prices (and few extra tips), here a few random offers sorted by price.

    The documents required (by Sectigo, in my case) for obtaining an OVL are:

    The whole verification process (especially phone) took like 2 months because they involved some kind of automatic calling that did not work on my line/phone?.

    I will post soon the number of downloads necessary to get reputation for your newly signed exe file. At this point, I can tell you that 1000 downloads are not enough.