Signing for Windows

Without a signature, SmartScreen warns every person who downloads your game, and keeps warning until enough people click through. With one, it stops.

What you need

A code signing certificate from a certificate authority — DigiCert, Sectigo, SSL.com and others sell them. There are two grades:

• OV (organisation validated) is the cheaper one and is what most small studios buy. It still carries a SmartScreen reputation period.
• EV (extended validation) clears SmartScreen immediately and costs more.

Both now generally arrive on a hardware token or in a cloud HSM rather than as a file you can download, because the CA/Browser Forum required it. If yours is a file you can export, it is an older certificate.

Getting a .pfx

If your certificate is still exportable, export it with its private key:

1. Open certmgr.msc on Windows, find it under Personal → Certificates.
2. Right click → All Tasks → Export.
3. Choose Yes, export the private key — a certificate without it cannot sign anything.
4. Pick PFX, set a password, and save the file.

On macOS or Linux, if you have the certificate and key as PEM:

openssl pkcs12 -export -out certificate.pfx -inkey private.key -in certificate.crt

What to put in Forge

About the timestamp server

Set it. http://timestamp.digicert.com works for most certificates.

Without a timestamp, your signature stops being valid when the certificate expires — which means every copy of your game you ever shipped starts warning on the same day, including the ones people already downloaded. With one, the signature stays valid for what it was when it was signed.

If your certificate lives on a token

Forge cannot use it. A hardware token needs a machine with the token plugged in, and a cloud HSM needs that provider's signing plug-in. This is the one place where the industry is moving faster than most build services; if this is your situation, tell us and we will work out what is possible.