aethercert
Sign code

Code signing certificates and Authenticode signing

Request a code signing certificate, or create a self-signed one for testing, and sign exe, dll, msi and PowerShell scripts with an RFC 3161 timestamp - using a certificate from the Windows store, a USB token, an HSM or a PFX.

Download for WindowsDocumentation

Version 1.1.2 · 27 October 2026 · Windows x64 · free · Download the aethercert Toolkit

Illustration of the aethercert Toolkit window with example data.
01Sign code

Signing with the Authenticode Windows already has

Sign code uses Windows' own Authenticode, through the PowerShell every Windows ships, driven by a fixed script: the file list and any PFX password go in on stdin, never on a command line. That covers every format Windows signs, and certificates whose key sits on a smart card, a USB token or an HSM.

Since June 2023, publicly trusted code signing certificates must keep their private key on hardware such as a token or an HSM. A key the Toolkit generates in software therefore suits an internal CA - Active Directory Certificate Services, for example - and testing. With a public certificate on a token, the Toolkit signs using that token.

From certificate to signed file

  1. 01

    Get a certificate

    Create a code signing CSR for your internal CA, a self-signed certificate for a test lab, or use the certificate on your token.

  2. 02

    Pick the files

    exe, dll, sys, msi, cab, cat, PowerShell scripts (ps1, psm1, psd1) and Windows Script files; existing signatures are shown per file.

  3. 03

    Choose certificate and timestamp

    A certificate from the store - tokens and HSMs included - or a PFX, and a timestamp server; DigiCert, Sectigo and GlobalSign are preset.

  4. 04

    Sign and verify

    Windows signs each file, and the Toolkit reports success only after Windows has verified each signature and its timestamp.

What Sign code covers

Every format Windows signs

Executables, libraries, drivers, installers, cabinets, catalogs, PowerShell scripts and Windows Script files.

Tokens and HSMs

Certificates whose key lives on a USB token or an HSM appear with the rest of the Windows store.

RFC 3161 timestamps

A timestamped signature stays valid after the signing certificate expires.

Signature check

Shows the signature and timestamp state of each file before and after signing; actk verify does the same in scripts.

Code signing CSRs

The code signing profile in Create CSR requests the code signing key usage from your CA.

Self-signed for testing

A self-signed code signing certificate with PFX, for test machines that trust it explicitly.

Sign in a build script

actk signs and verifies from a pipeline or a build server, with the certificate selected by thumbprint or from a PFX.

actk csr --profile codesign --cn "Example GmbH" --org "Example GmbH" --country DE --key rsa3072actk certsactk sign Setup.exe deploy.ps1 package.msi --thumbprint 0123ABCD...actk sign tool.exe --pfx codesign.pfx --timestamp http://timestamp.sectigo.comactk verify Setup.exe

More tools in the Toolkit

CSR generatorCreate a CSR for any CA - server, user or code signing.Certificate scannerFind every TLS certificate on your network, with expiry and issuer.TLS security scanGrade internal hosts A+ to F: protocols, ciphers, certificate, headers.PFX converterCertificate and key to PFX, and PFX to PEM, CER and key.Certificate managerThe Windows certificate store: import, export, renew and delete.

All Toolkit tools

Documentation

Frequently asked questions

Code signing

Can I create a publicly trusted code signing certificate with the Toolkit?

Not the key: public CAs require the key of a code signing certificate to be generated and kept on hardware, so they issue it on a token or HSM. The Toolkit's code signing CSR is for internal CAs; it signs with any certificate in the Windows store, tokens included.

Why should I timestamp a signature?

Without a timestamp the signature becomes invalid when the certificate expires. With an RFC 3161 timestamp, Windows still accepts it afterwards.

Which files can I sign?

exe, dll, sys, msi, cab, cat, PowerShell scripts and modules (ps1, psm1, psd1) and Windows Script files - every format Authenticode supports on Windows.

Is my PFX password exposed while signing?

No. The password reaches PowerShell on stdin, not as a command-line argument, so it does not show up in process lists or logs.

Does a file signed with an internal certificate pass SmartScreen?

Machines that trust your internal CA see a valid signature, which is what group policies and AppLocker rules check. SmartScreen reputation is tied to publicly trusted certificates.

Certificates for servers, not just code?

aethercert renews TLS certificates and installs them on IIS, Exchange, NGINX, load balancers and firewalls - automatically, before they expire.

Get started free How aethercert works

Community plan, no card required. Open registration - your account is ready in a few minutes.