--- title: So you want to sign for Windows? | daily.dev description: A walkthrough on properly code signing Windows executables to avoid the 'Unknown publisher' warning, covering purchasing a DigiCert code signing certificate,... canonical: https://daily.dev/posts/so-you-want-to-sign-for-windows--banfgaedn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: So you want to sign for Windows? | daily.dev og:description: A walkthrough on properly code signing Windows executables to avoid the 'Unknown publisher' warning, covering purchasing a DigiCert code signing certificate,... og:url: https://daily.dev/posts/so-you-want-to-sign-for-windows--banfgaedn og:image: https://api.daily.dev/og/posts/bANFGAeDN.png og:image:alt: So you want to sign for Windows? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # So you want to sign for Windows? **[ngrok Blog](https://daily.dev/sources/ngrok)** · 5 min read · 0 upvotes · 0 comments ## Summary A walkthrough on properly code signing Windows executables to avoid the 'Unknown publisher' warning, covering purchasing a DigiCert code signing certificate, generating a CSR with openssl, adding metadata with go-winres, and signing the executable with osslsigncode. The guide is aimed at *nix developers publishing Go binaries for Windows and recommends automating the entire pipeline. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I sign a Windows executable built with Go on Linux or macOS? Purchase a code signing certificate from a certificate authority like DigiCert, generate a certificate signing request with openssl (openssl genrsa followed by openssl req new), then use osslsigncode with your .crt and .key files to sign the compiled Go binary on any Linux or macOS machine, since osslsigncode is built on OpenSSL and cURL. _daily.dev surfaces practical guides like this for developers automating cross-platform release pipelines._ ### How do I add a custom icon and metadata to a Go executable for Windows? Use go-winres to generate a resource (.rsrc) file containing icons and version metadata, then place it alongside the Go source before running go build, which automatically embeds it into the compiled executable. This step must happen before code signing and is optional but improves the branding of the final binary. _Developers polishing Windows release builds can track tooling tips like this on daily.dev._ ### Should I choose an Extended Validation (EV) code signing certificate or a standard one? Standard certificates are easier to automate, while Extended Validation (EV) certificates provide a higher level of trust but require two-factor authentication as part of the signing process, adding friction to automated build pipelines. Teams optimizing for automation may choose to forgo EV validation and use a standard certificate instead. _daily.dev helps developers weighing security tradeoffs like EV versus standard code signing certificates._ ## Similar posts on daily.dev - [How to Sign a Windows App with Electron Builder?](https://daily.dev/posts/how-to-sign-a-windows-app-with-electron-builder--o4f6nhgta) · Security Boulevard · 0 upvotes · 0 comments - [Automatically Signing a Windows EXE with Azure Trusted Signing, dotnet sign, and GitHub Actions](https://daily.dev/posts/automatically-signing-a-windows-exe-with-azure-trusted-signing-dotnet-sign-and-github-actions-xw4znfsaz) · Scott Hanselman · 0 upvotes · 0 comments - [Code signing Windows apps may be easier and more secure with new Azure Artifact service • DEVCLASS](https://daily.dev/posts/code-signing-windows-apps-may-be-easier-and-more-secure-with-new-azure-artifact-service-devclass-txcjnjyqb) · DEVCLASS · 2 upvotes · 0 comments - [Windows 11's driver signature requirement is one of the best anti-consumer security features out there](https://daily.dev/posts/windows-11-s-driver-signature-requirement-is-one-of-the-best-anti-consumer-security-features-out-the-peze2jn3v) · XDA Developers · 0 upvotes · 0 comments - [How to Sign ClickOnce Manifests with Visual Studio using the KSP Library?](https://daily.dev/posts/how-to-sign-clickonce-manifests-with-visual-studio-using-the-ksp-library--syuwy1vow) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#windows](https://daily.dev/tags/windows), [#golang](https://daily.dev/tags/golang), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/so-you-want-to-sign-for-windows--banfgaedn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"So you want to sign for Windows?","url":"https://daily.dev/posts/so-you-want-to-sign-for-windows--banfgaedn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/so-you-want-to-sign-for-windows--banfgaedn"},"datePublished":"2026-08-23T07:21:35.974Z","dateModified":"2026-08-23T07:26:53.284Z","description":"A walkthrough on properly code signing Windows executables to avoid the 'Unknown publisher' warning, covering purchasing a DigiCert code signing certificate,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/174470ed50b779f542321020e656e9a7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/174470ed50b779f542321020e656e9a7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/so-you-want-to-sign-for-windows--banfgaedn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"windows,golang,cryptography","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"So you want to sign for Windows?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/so-you-want-to-sign-for-windows--banfgaedn#faq","mainEntity":[{"@type":"Question","name":"How do I sign a Windows executable built with Go on Linux or macOS?","acceptedAnswer":{"@type":"Answer","text":"Purchase a code signing certificate from a certificate authority like DigiCert, generate a certificate signing request with openssl (openssl genrsa followed by openssl req new), then use osslsigncode with your .crt and .key files to sign the compiled Go binary on any Linux or macOS machine, since osslsigncode is built on OpenSSL and cURL. daily.dev surfaces practical guides like this for developers automating cross-platform release pipelines."}},{"@type":"Question","name":"How do I add a custom icon and metadata to a Go executable for Windows?","acceptedAnswer":{"@type":"Answer","text":"Use go-winres to generate a resource (.rsrc) file containing icons and version metadata, then place it alongside the Go source before running go build, which automatically embeds it into the compiled executable. This step must happen before code signing and is optional but improves the branding of the final binary. Developers polishing Windows release builds can track tooling tips like this on daily.dev."}},{"@type":"Question","name":"Should I choose an Extended Validation (EV) code signing certificate or a standard one?","acceptedAnswer":{"@type":"Answer","text":"Standard certificates are easier to automate, while Extended Validation (EV) certificates provide a higher level of trust but require two-factor authentication as part of the signing process, adding friction to automated build pipelines. Teams optimizing for automation may choose to forgo EV validation and use a standard certificate instead. daily.dev helps developers weighing security tradeoffs like EV versus standard code signing certificates."}}]} ```