Windows Code Signing

Users who download your Tauri app from the internet will almost certainly encounter a full-screen warning from Windows SmartScreen if the binary is not signed. "Windows protected your PC" with a blocked run button is the default experience for any unsigned executable. Code signing replaces that experience with a publisher name and a smooth install flow — and in many enterprise environments, unsigned software is simply rejected by policy.

This guide covers everything you need to sign your Tauri v2 Windows executables: what certificates are available, how to configure signing with an OV certificate you already own, how to use Azure Key Vault for cloud‑based signing, and how to automate everything in CI. Pair this with Windows packaging.

Why Code Signing Matters on Windows

Windows ships with SmartScreen, a reputation-based filter that checks every downloaded executable. If a file has no valid digital signature, SmartScreen blocks it with a strong warning. If it is signed but the publisher has little download history, SmartScreen shows a milder "unrecognized app" prompt — still a friction point. A well-signed application that has accumulated reputation over many downloads eventually runs without any prompt at all.

Code signing proves two things: the software came from you (authenticity) and it hasn’t been tampered with since you signed it (integrity). The signature is checked against a certificate issued by a trusted Certificate Authority, and if valid, Windows displays your organization’s name in the User Account Control and SmartScreen dialogs.

For apps distributed outside the Microsoft Store, signing is not technically mandatory — but distributing unsigned software is a sure way to lose users before they even try your app.

Types of Signing Certificates

You can sign Windows executables with several kinds of certificates. Tauri supports all of them either directly or through a custom sign command.

OV (Organization Validated) Certificates

The standard choice for most independent developers and small teams. A Certificate Authority validates your legal organization identity before issuing the certificate. Once signed, your app’s publisher name appears in Windows prompts. Reputation builds over time as more users download and run your software.

EV (Extended Validation) Certificates

EV certificates require a more rigorous identity check and the private key must be stored on a hardware security module (HSM). Historically, EV certificates bypassed SmartScreen instantly, but Microsoft changed this behavior in 2024. EV‑signed files now build reputation the same way OV certificates do. EV certificates are still required for signing kernel-mode drivers, but for a typical Tauri desktop app they offer no SmartScreen advantage over OV.

Azure Artifact Signing (formerly Trusted Signing)

Microsoft’s own cloud code signing service. You validate your identity once with Microsoft, then sign directly from your build pipeline without managing physical tokens. It costs roughly $9.99 per month and is the most straightforward path for automated signing in CI/CD. It provides the same OV-level reputation model. Availability is currently limited to specific regions (organizations in the US, Canada, EU, UK; individuals in US and Canada only).

Signing Your Tauri App

The method you choose depends on where your signing key lives. Pick the tab that matches your setup.

openssl pkcs12 -export -in cert.cer -inkey private-key.key -out certificate.pfx

$WINDOWS_PFX_PASSWORD = 'YOUR_EXPORT_PASSWORD'
Import-PfxCertificate -FilePath certificate.pfx -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $WINDOWS_PFX_PASSWORD -Force -AsPlainText)

{
  "bundle": {
    "windows": {
      "certificateThumbprint": "A1B1A2B2A3B3A4B4A5B5A6B6A7B7A8B8A9B9A0B0",
      "digestAlgorithm": "sha256",
      "timestampUrl": "http://timestamp.digicert.com"
    }
  }
}

npm run tauri build

info: signing app
info: running signtool "C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\signtool.exe"
info: "Done Adding Additional Store\r\nSuccessfully signed: APPLICATION FILE PATH HERE"

Automated Signing with GitHub Actions

Once you have signing working locally, you can automate it in CI. The following workflow snippet imports an OV certificate into the Windows runner and then builds with the Tauri action.

name: publish
on:
  push:
    branches:
      - release
jobs:
  publish-tauri:
    strategy:
      fail-fast: false
      matrix:
        platform: [windows-latest]
    runs-on: ${{ matrix.platform }}
    steps:
      - uses: actions/checkout@v4
      - name: setup node
        uses: actions/setup-node@v4
        with:
          node-version: 20
      - name: install Rust stable
        uses: actions-rs/toolchain@v1
        with:
          toolchain: stable
      - name: import windows certificate
        if: matrix.platform == 'windows-latest'
        env:
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
        run: |
          New-Item -ItemType directory -Path certificate
          Set-Content -Path certificate/tempCert.txt -Value $env:WINDOWS_CERTIFICATE
          certutil -decode certificate/tempCert.txt certificate/certificate.pfx
          Remove-Item -path certificate -include tempCert.txt
          Import-PfxCertificate -FilePath certificate/certificate.pfx -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -Force -AsPlainText)
      - name: install app dependencies and build it
        run: npm ci && npm run build
      - uses: tauri-apps/tauri-action@v0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tagName: app-v__VERSION__
          releaseName: 'App v__VERSION__'
          releaseBody: 'See the assets to download this version and install.'
          releaseDraft: true
          prerelease: false

The two GitHub secrets you need:

For Azure Key Vault, replace the certificate import step with environment variable exports for AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET (stored as GitHub secrets) and ensure relic is installed via cargo install relic before the Tauri action runs.

Verifying the Signature

After building, you can confirm the signature is present. In File Explorer, right‑click the .exe or installer, select Properties, and open the Digital Signatures tab. You should see your publisher name and a timestamp. Click Details → View Certificate to inspect the full chain.

For command‑line verification, use signtool:

signtool verify /pa /v path/to/your-app.exe

A successful verification ends with Successfully verified: path\to\your-app.exe.

Common Mistakes and Troubleshooting

Summary

Windows code signing moves your Tauri application from a blocked unknown binary to a trusted installer. The quickest path for individual developers is an OV certificate combined with the simple certificateThumbprint configuration. For teams that want to keep the private key in the cloud and integrate seamlessly with CI, Azure Key Vault with relic is the recommended approach. Both methods integrate cleanly with Tauri’s build pipeline and the tauri-action GitHub Action.