What do we actually need for digitally signing an executable?

[tst]

I'm trying to understand what's actually needed for digitally signing a LabVIEW EXE/installer. While there is some content online (example), it seems like things have changed in the last few years (for example, it looks like you need a secure device for storing a key).

Can anyone give the details of the actual process? What do you buy? How do you configure it, etc.?

[Taggart]

---

@tst wrote:

I'm trying to understand what's actually needed for digitally signing a LabVIEW EXE/installer. While there is some content online (example), it seems like things have changed in the last few years (for example, it looks like you need a secure device for storing a key).

Can anyone give the details of the actual process? What do you buy? How do you configure it, etc.?

---

Check out the 2 most recent episodes of Security Now. It talks about code signing and the recent changes.

episodes 1059 and 1060.

In the show notes for 1060 you'll find a link to here:
https://weblog.west-wind.com/posts/2025/Jul/20/Fighting-through-Setting-up-Microsoft-Trusted-Signing

[avogadro5]

I have only used it due to IT policy. All the computers running my exes blocked all binaries except ones IT specifically whitelisted (which they did on request by me sending them the binary) or those signed with a trusted certificate. So the easiest way to deploy my code was to sign it first.

This was at a Fortune 500 defense contractor so there were extensive processes for everything including IT security.

[Taggart]

Also if anyone is planning on buying a signing certificate, do it now. If you buy it in the next month or so it is good for 3 years. After that they'll only be good for one year.