Reputation with OV certificates and are EV certificates still the better option?

Question

Hi, I'm an indie developer writing an Electron application. I've registered a cooperation in Canada a few months ago and I purchased an OV certificate for my software.

The poor wording of the Windows Smart Screen Defender makes most of my non-technical users think he just downloaded a malware application.

Windows Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk.

Also the hidden "More Info" button in the dialog doesn't help at all. So my OV certificate is basically useless because it scares off the potential customers. At the same time I need a few hundred or thousand downloads for the message to disappear. That makes absolutely no sense. And I can't just sit this out because most customers will not come back a second time after that experience.

I understand the motivation but its poorly executed and indie developers like me are screwed because of this. I already submitted my application twice through the Windows "File Submission" form. So my questions are...

1) What can I do to speedup the process?
2) Are EV certificates still the better option? Do they still get the "instant" reputation these days? An agent at DigiCert mentioned this is not the case anymore.

Any help from the MS team is highly appreciated!

Answer 1

HI Sebastian-5089,

Thanks for your waiting.

1.I've registered a cooperation in Canada a few months ago
Do you mean you have registered a business company in Canada? If the answer is yes, I think EV certificate is available.

2.Are EV certificates still the better option?
yes. If there is signed driver file included in your electron application, EV code signing certificate is required to establish a Windows Hardware Dev Center dashboard account.

"Signing your code is not required to earn a SmartScreen reputation, but EV-signed code’s extra level of trust lets developers skip this hurdle altogether:

An EV code signing certificate offers an immediate reputation with Microsoft SmartScreen, so your users will never have to click through a SmartScreen warning in Windows.
With an OV certificate, SmartScreen reputation must be built organically, as users download and install your files. SmartScreen warnings may occur until enough software proves sufficiently popular with Windows users for SmartScreen to view it as “well known.”
Unfortunately, Microsoft does not publish guidelines on what constitutes enough downloads to eliminate SmartScreen warnings. Microsoft has also indicated in the past that signing code is a “best practice” that you “can follow to help establish and maintain reputation for your applications.”

Do they still get the "instant" reputation these days?
From below document and I think it will be come true, we can contact SSL third party certificate company.

Which Code Signing Certificate do I Need? EV or OV?
https://www.ssl.com/faqs/which-code-signing-certificate-do-i-need-ev-ov/

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

**A new EV certificate does NOT give an immediate SmartScreen bypass. **

**
Recently in August 2023 we obtained an EV certificate from Sectigo/Comodo and Yubico hardware HSM, which is now mandatory. We've been code signing for well over a decade with OV's, and as CA's advertise instant reputation with SmartScreen (which is false as it turns out), we decided this time to go that route. We had to request three certificates from Sectigo after they made a typo in the company name first of all (I don't know how that could happen as the CSR was correct) and then there was an issue with the 2nd, and after finally being able to sign correctly with the 3rd certificate, we tested a download of a signed exe. SmartScreen appeared.

**
So caveat emptor, despite what the CA's advertise, an EV does not give immediate trust to an exe. We submit fresh exe's to Microsoft, reporting an incorrect SmartScreen detection, and they quickly get scanned and within typically a few hours a response is received saying that the application will no longer receive warnings with SmartScreen. At the moment for us it also says that the certificate is gaining trust and once it has, signed programs will then be automatically trusted. A dampener to this is that we are submitting four installer exes at a time (in separate submissions), and sometimes only the first completes in a few hours; the others can take hours longer. I wondered if it's because the names are the same, and Microsoft think we're impatient and submitting the same program four times, or whether there is some penalty for "overusing" the service.

An EV might still make sense over an OV, but as we found, the process of getting setup, particularly if under time constraints, and then on an ongoing basis can be pretty stressful and horrible.

Answer 3

I understand your concern about Windows SmartScreen causing issues for your Electron application. Here are short answers to your questions:

To speed up the process, consider gathering more positive feedback, using trusted code signing certificates, and building a reputation for your software.

EV (Extended Validation) certificates used to offer an "instant" reputation boost, but this has changed over time. EV certificates may still help, but they're not a guaranteed solution. You can find more details on the differences between EV and OV certificates in this reference link: Differences between EV and OV Code Signing Certificates.

Ultimately, improving your software's reputation and user feedback may be the most effective way to address the SmartScreen issue.