When we (Freedom of the Press Foundation) took stewardship of the Dangerzone project from Micah, we had to purchase a code signing certificate for our Windows binaries.
The purpose of code signing certificates is to tie the identity of an organization or individual to an artifact. In Windows land, this is essential in order to avoid SmartScreen warnings. Here's how one looks like:
Back in January 2023, we decided to buy an Extended Validation (EV) code signing certificate from Certum. The rationale was that this certificate could:
- Display the name of the organization when installing the app.
- Bypass SmartScreen issues completely.
- Require a hardware token in order to sign.
The price for these features is high for an open-source project ($800/3years), but we didn't want to scare security-conscious users with SmartScreen warnings, so we decided to proceed.
A few years later...
Since 2023, several things have changed.
The main issue is that our certificate expired on April 16th, 2026 after three years of use (😢). That's the reason why the 0.11.0 release does not contain any Windows binaries.
Once we realized that our certificate had expired, we were about to start the renewal process. That's when we realized though that Microsoft nerfed EV certificates on 2024:
EV certificates — no longer recommended for SmartScreen
Extended Validation (EV) certificates previously bypassed SmartScreen entirely on first download, making them the go-to choice for new apps with no reputation. That behavior was removed in 2024. EV-signed files now go through the same reputation-building process as OV certificates. (link)
We didn't take notice of this because EV certificates issued before this change had built the necessary reputation:
If you already have an EV certificate, it is still valid and functional for signing — keep using it until it expires (link)
Renewing our certificate therefore means that we may start from scratch. Certificate providers (here, Digicert) can't guarantee that a publisher's reputation will transfer to the new certificate:
Will reputation transfer to a renewed code signing certificate?
Publisher continuity may help preserve reputation signals, but Microsoft does not publicly document exact reputation transfer behavior. (link)
At the same time, Microsoft has started offering OV certificates via Azure Artifact Signing. These certificates have some perks:
- We can sign directly from our CI, instead of a dedicated Windows machine, which has been a source of pain and confusion in the past few years.
- The price ($9.99/month) is comparable to Apple's price, and doesn't lock you in a 3-year contract.
Current situation
Where do the above leave us? We still need a new code signing certificate to sign Windows releases. Because we don't sign kernel drivers, we no longer need an EV certificate, and can explore other options, such as Azure Artifact Signing. We'll update this issue with more info as we process this situation.
When we (Freedom of the Press Foundation) took stewardship of the Dangerzone project from Micah, we had to purchase a code signing certificate for our Windows binaries.
The purpose of code signing certificates is to tie the identity of an organization or individual to an artifact. In Windows land, this is essential in order to avoid SmartScreen warnings. Here's how one looks like:
Back in January 2023, we decided to buy an Extended Validation (EV) code signing certificate from Certum. The rationale was that this certificate could:
The price for these features is high for an open-source project ($800/3years), but we didn't want to scare security-conscious users with SmartScreen warnings, so we decided to proceed.
A few years later...
Since 2023, several things have changed.
The main issue is that our certificate expired on April 16th, 2026 after three years of use (😢). That's the reason why the 0.11.0 release does not contain any Windows binaries.
Once we realized that our certificate had expired, we were about to start the renewal process. That's when we realized though that Microsoft nerfed EV certificates on 2024:
We didn't take notice of this because EV certificates issued before this change had built the necessary reputation:
Renewing our certificate therefore means that we may start from scratch. Certificate providers (here, Digicert) can't guarantee that a publisher's reputation will transfer to the new certificate:
At the same time, Microsoft has started offering OV certificates via Azure Artifact Signing. These certificates have some perks:
Current situation
Where do the above leave us? We still need a new code signing certificate to sign Windows releases. Because we don't sign kernel drivers, we no longer need an EV certificate, and can explore other options, such as Azure Artifact Signing. We'll update this issue with more info as we process this situation.