14

I know that even a software signed with a new code signing certificate triggers Microsoft Defender SmartScreen warning:

Windows Defender SmartScreen prevented an unrecognized app from starting

The warning goes away only after the certificate builds a reputation:
Smart-Screen filter still complains, despite I signed the executable, why?


But we are signing our software (WinSCP) with DigiCert code signing certificate for years. It is a plain certificate, no Extended Validation (EV).

As our certificate is expiring soon, we have renewed it. But now, signed with the renewed certificate, our software triggers the SmartScreen warning.

Is that expected? Is the reputation really not transferred to the renewed certificate? If not, what does it take to build the reputation again? The new (beta) version of our software (signed with the renewed certificate) is out for few days already, and it has tens of thousands of installations, but it still triggers the warning. Or is there a way to help the reputation to transfer somehow?

We have tried to submit the files for malware analysis to Microsoft. Although the binaries passed the tests, it did not have visible effect on the SmartScreen check.

  • 2
    We face this situation each time we renew our Authenticode certificate. Without EV, you must build the reputation from the scratch. – Jozef Izso Dec 2 '19 at 11:26
  • 1
    It takes few weeks while we use our internal builds and no longer than month. – Jozef Izso Dec 2 '19 at 13:16
  • 1
    More here... blogs.msdn.microsoft.com/ie/2012/08/14/… However, how long does it take to build reputation for a new certificate? – Petr Dec 2 '19 at 21:39
  • 4
    Yes, we must use the software internally long enough so customers do not face the SmartScreen information. Usually we don't see it after few days when up to 10 people use it. – Jozef Izso Dec 5 '19 at 9:37
  • 1
    @JozefIzso Only ~ 10 people is enough such that future customers won't see it again? – Basj Sep 8 at 9:30
5

To complement the comment by @JozefIzso: The binary became trusted after about one month. While the further release become trusted after about 10 days only, third release did not become trusted for weeks again.

It does not look like a standard code signing certificate can be used nowadays. We gave up and went for EV certificate.

| improve this answer | |
  • 1
    Thank you for this answer @MartinPrikryl. A few details: (1) "The binary became trusted after about one month.": just to get the order of magnitude, how many downloads / installs by end users were needed? (I think that's this count that increases the reputation, is that right?) -- (2) "the further release become trusted after about 10 days only, third release did not become trusted for weeks again": does this mean that if mysoftware-v.1.0.1.exe is finally trusted, then you start with reputation=0 again for mysoftware-v.1.0.2.exe, really? – Basj Sep 8 at 9:08
  • @Basj Yes, that's what our experience was like. + As my question says, the respective (beta) releases had several tens of thousand downloads. – Martin Prikryl Sep 8 at 9:24
  • 1
    Thanks for your answer. So I can't expect to see the SmartScreen messages disappear for my users if, say, only 100 users have downloaded it? Do you confirm this comment? "Usually we don't see it after few days when up to 10 people use it. – Jozef Izso" – Basj Sep 8 at 9:29
  • PS: before going the EV certificate route, did you try microsoft.com/en-us/wdsi/filesubmission, did it help? – Basj Sep 8 at 9:29
  • No, I do not confirm that comment. + Yes, we tried the file submission. It did not help. – Martin Prikryl Sep 8 at 9:42
2

As you've figured out you can't transfer it, and you're stuck without using EV. Because you've got a new certificate, it took some time for your software to be verified as safe. What I think is happening now is that your signing certification is still seen as relatively new, and needs to build up reputation, but because the previous software release was all ok I would expect that reputation build up is quicker this time.

The only definite way to speed this up is to get EV certificates. However, by submitting new releases here: https://www.microsoft.com/en-us/wdsi/filesubmission you may be able to increase reputation. This blog has some interesting statistics and spotted some potential patterns: https://www.coretechnologies.com/blog/windows/microsoft-smartscreen-filter/

One potential way to get around this, at least relatively recently, was to have an installer that changes code very infrequently. This code then downloads the program in the background and this would often work. Unfortunately, I don't think that's going to work for WinSCP (which is very useful btw, keep up the good work!).

| improve this answer | |
  • Thanks for your response. I have posted the first version of WinSCP signed with the renewed certificate to Microsoft already, right after the release, after the problem appeared. Though after the message did not go away in few days, I've withdrew that release. So I cannot really tell what impact, if any, it had. – I've submitted the new version of WinSCP now too, just in case... – The blog post is rather dated. SmartScreen is now built-in in Windows 10 and the check is triggered, no matter what browser you use to download the file. – Martin Prikryl Jan 8 at 8:50
  • Yes, unfortunately soz which is why I doubt the second solution works now. – LTPCGO Jan 8 at 10:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.