How to digitally sign the executable of your MU Online client

When a player downloads your MU Online server's client and Windows shows "Unknown publisher," or the antivirus blocks main.exe for no apparent reason, the abandonment rate on first contact spikes — many people simply give up on installing. Digitally signing the client executable solves a large part of this problem: it proves the file comes from an identifiable source and hasn't been altered since signing, which reduces SmartScreen alerts and improves the community's perceived trust. This tutorial covers everything from choosing a certificate to the technical signing process and ongoing maintenance.

Why sign the client executable

An unsigned executable, when downloaded from the internet, automatically receives Windows' "Mark of the Web" attribute, which triggers SmartScreen on first run, showing the yellow "Windows protected your PC" warning. Many antivirus programs also use the absence of a signature as one of several signals when deciding whether to quarantine a file preemptively. Signing the executable with a valid certificate from a recognized certificate authority eliminates the most basic cause of these alerts and starts building publisher reputation over time.

Types of code signing certificates

For a MU Online private server on a limited budget, an OV certificate already brings a noticeable improvement, especially combined with consistent download volume over time. An EV certificate is ideal if the project already has recurring revenue (donations, VIP, shop) that justifies the higher investment.

Where to get the certificate

Certificate authorities recognized by Windows for code signing include DigiCert, Sectigo (formerly Comodo), and GlobalSign, among others resold by local partners in Brazil. The typical process involves: registering the entity (individual or company), submitting supporting documents, phone validation (mainly for EV), and certificate issuance, usually delivered on a physical USB token (mandatory for EV, recommended for OV).

Preparing the signing environment

To sign on Windows, the standard tool is signtool.exe, distributed with the Windows SDK. Check whether it's installed:

where signtool

If not found, install the Windows SDK (the "Signing Tools for Desktop Apps" component is enough, no need for the full SDK).

Signing the executable with signtool

With the certificate installed in the Windows certificate store (or the token connected), the basic signing command is:

signtool sign /n "Your Company Name" /t http://timestamp.digicert.com /fd sha256 "C:\Client\main.exe"

• /n specifies the certificate name to use (must match the registered name).
• /t points to a timestamp server — essential, as it keeps the signature valid even after the certificate expires.
• /fd sha256 sets the hash algorithm, the current recommended standard.

To sign multiple files at once (launcher, main.exe, auxiliary DLLs), use a loop:

for %f in (main.exe launcher.exe patcher.exe) do signtool sign /n "Your Company Name" /t http://timestamp.digicert.com /fd sha256 "C:\Client\%f"

Verifying the signature

After signing, always validate before distributing:

signtool verify /pa /v "C:\Client\main.exe"

The /pa parameter uses the default Authenticode verification policy. If the output shows "Successfully verified," the file is correctly signed with a valid timestamp.

Signing the launcher and installer

Don't sign only the game's main.exe — the launcher (responsible for updating files and starting the client) is usually the first executable the player runs, and it's where the SmartScreen alert appears first. If you distribute an installer (Setup.exe generated by Inno Setup, NSIS, etc.), sign the final installer as well, after compiling, not just the internal files.

Automating signing in the build process

If the server ships client updates frequently, integrate signing into the build pipeline instead of doing it manually every time. A simple post-build script:

@echo off
signtool sign /n "Your Company Name" /t http://timestamp.digicert.com /fd sha256 "%1"
if %errorlevel% neq 0 (
    echo ERROR: failed to sign %1
    exit /b 1
)
echo Successfully signed: %1

Call this script as the last step of the build, for every generated executable, and fail the release process if signing doesn't work — this avoids accidentally distributing an unsigned binary.

Building reputation with SmartScreen

Even with a valid certificate, Windows SmartScreen uses a reputation system based on download volume and reports. In the first weeks after switching certificates (or using a new one), it's normal to still see some alerts. Reputation is built through: consistent download volume of the same signed binary, absence of user reports, and time. Avoid re-signing the same file with different hashes unnecessarily — each new hash starts building reputation from zero.

Common errors and fixes

Client signing checklist

• Code signing certificate (OV or EV) obtained from a recognized authority.
• signtool installed and tested locally.
• main.exe, launcher, and installer signed, not just the main executable.
• Timestamp included in every signature.
• Verification (signtool verify) run after each signing.
• Signing process automated in the build/release pipeline.
• SmartScreen reputation monitored in the first weeks after release.

With the client signed and more trustworthy for players to download, it's worth complementing this security layer by also reviewing the project's web-facing entry points (site, online launcher, download area) through the web vulnerability audit guide.

Frequently asked questions