Complete Guide to Code Signing for Electron.js Applications on Windows

Code signing is a crucial step in distributing an Electron.js application for Windows. It ensures your application is secure, authentic, and trusted by end users. This guide will walk you through the entire process of obtaining, configuring, and using a Windows Code Signing Certificate to sign your Electron app, along with cost estimates and best practices.

---

Why Do You Need a Code Signing Certificate?

Code signing certificates provide several benefits for your Electron.js app:

1. Prevent Security Warnings: Unsigned apps trigger warnings like “Unknown Publisher” in Windows SmartScreen, deterring users.
2. Build Trust: Signed apps display the publisher’s name, creating credibility.
3. Ensure Integrity: Guarantees that the app hasn’t been tampered with after signing.
4. Compliance: Mandatory for distributing apps through the Microsoft Store or enterprise environments.

---

Types of Code Signing Certificates

1. Standard Code Signing Certificate

• Suitable for small developers or individual projects.
• Requires basic organization or individual validation.
• Cheaper but requires app downloads to build Microsoft SmartScreen reputation.

2. Extended Validation (EV) Code Signing Certificate

• Recommended for broad audience distribution.
• Provides immediate trust with Microsoft SmartScreen without building reputation.
• Requires stricter validation, including physical verification of the organization.
• Comes with a USB token for enhanced security.

Certificate Type	Cost Estimate (Per Year)	Best For
Standard	$70 – $300	Small teams, developers
EV	$300 – $700	Enterprise apps, large distribution

Popular vendors include:

• DigiCert
• Sectigo
• GlobalSign
• Entrust
• GoDaddy

---

Step-by-Step Guide to Code Signing an Electron App

Step 1: Purchase a Code Signing Certificate

1. Choose a Trusted Certificate Authority (CA): Select from reputable providers like DigiCert, Sectigo, or GlobalSign.
2. Submit Required Information:
   • Individual Developers: Provide government-issued ID and proof of address.
   • Organizations: Provide business registration documents, phone number, and address verification.
3. Complete Verification:
   • For Standard Certificates, the process is usually completed within 1-3 days.
   • For EV Certificates, physical verification (like a phone call or courier) can take up to 5 days.
4. Download Your Certificate:
   • For Standard Certificates: Download the .pfx file from the CA’s portal.
   • For EV Certificates: Use the USB token provided by the CA.

---

Step 2: Install the Certificate

Standard Certificate (.pfx)

1. Save the .pfx file locally.
2. Import it into your Windows Certificate Store:
   • Open the Microsoft Management Console (MMC).
   • Add the “Certificates” snap-in.
   • Import the .pfx file into the Personal Certificates store.

EV Certificate

No installation is needed. The USB token handles the signing process.

---

Step 3: Set Up Your Electron App for Signing

Install electron-builder

npm install electron-builder --save-dev

Update your package.json file with the following build configuration:

Example Configuration for Code Signing

{
  "build": {
    "appId": "com.example.myapp",
    "productName": "MyElectronApp",
    "files": [
      "dist/**/*",
      "node_modules/**/*"
    ],
    "win": {
      "target": "nsis", // or "msi"
      "icon": "build/icon.ico",
      "certificateSubjectName": "Your Organization Name", // Use for standard certs
      "signingHashAlgorithms": ["sha256"],
      "certificateFile": "./certs/your-certificate.pfx", // Path to .pfx file
      "certificatePassword": "your-password" // Password for the .pfx file
    }
  }
}

Key fields:

• certificateFile: Path to your .pfx file.
• certificatePassword: Password for the .pfx file.
• certificateSubjectName: Your organization’s name, as it appears in the certificate.
• signingHashAlgorithms: Use sha256 for modern security.

---

Step 4: Code Signing with SignTool (Optional)

SignTool is a command-line utility provided by Microsoft for signing applications. It’s commonly used with EV Certificates.

Signing Command for Standard Certificates

signtool sign /f your-certificate.pfx /p your-password /tr http://timestamp.digicert.com /td sha256 /fd sha256 "path/to/your/app.exe"

Signing Command for EV Certificates

signtool sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 "path/to/your/app.exe"

• /f: Path to .pfx file (not needed for EV Certificates).
• /tr: URL of the timestamp server.
• /td and /fd: Hashing algorithms (use SHA-256).

---

Step 5: Package and Test the Signed Application

1. Build the App:npm run build
2. Verify the Signature:signtool verify /pa "path/to/your/app.exe"
   • If successful, this confirms the app is signed correctly.
3. Test on a Clean Windows Machine:
   • Ensure there are no warnings or errors during installation.

---

Additional Considerations

Timestamping

• Timestamping ensures your app’s signature remains valid even after the certificate expires.
• Include a timestamp server in your configuration (e.g., http://timestamp.digicert.com).

Automating the Signing Process

• Integrate code signing into your CI/CD pipeline using tools like GitHub Actions or Jenkins.
• Example CI configuration for signing with electron-builder:- name: Sign and Build Electron App run: | npm install npm run build

---

Best Practices for Code Signing Electron Apps

1. Use EV Certificates for Larger Distribution: They provide immediate SmartScreen trust and avoid reputation delays.
2. Always Timestamp Signatures: This ensures long-term validity.
3. Test on Multiple Windows Versions: Verify functionality and trust levels on different OS versions.
4. Renew Certificates Early: Renew your certificate at least 30 days before expiration to avoid interruptions.
5. Secure Your Certificate:
   • For .pfx files, restrict access and use strong passwords.
   • For EV tokens, store them securely and limit usage to trusted personnel.

---

Conclusion

Signing your Electron.js application is essential for a smooth and secure user experience on Windows. Whether you’re an individual developer or part of a large team, following this guide will help you distribute a trusted and tamper-proof application. By investing in the right code signing certificate and adhering to best practices, you can enhance your app’s credibility and reach.

If you have any questions or face issues during the signing process, feel free to reach out to your certificate authority or consult the official Electron documentation.

Don’t miss our Complete Guide to Code Signing for Electron.js Applications on macOS for a step-by-step approach to signing your app.