If your reason for buying an EV code signing certificate is to skip SmartScreen warnings, it is no longer a good reason. Microsoft says EV certificates no longer bypass SmartScreen. They can still matter for enterprise procurement or customer policy, so decide based on who needs to see the validation level.
What changed
Years ago, an EV signature gave a file positive SmartScreen reputation by default. Microsoft's current developer documentation says that behaviour no longer exists. Valid OV and EV certificates both lead to the same first-download behaviour: a prompt that shows the publisher name until reputation accumulates.
Microsoft adds that paying a premium for EV solely to avoid SmartScreen warnings is no longer justified. That is the vendor's own statement, so it is a safe basis for the decision.
What a certificate still gives you
Whatever the validation level, a code signing certificate gives you three things.
- Integrity: the file cannot be changed after signing without breaking the signature.
- Identity: users and endpoint tools can see who signed it.
- Continuity: reputation can attach to a stable identity across releases.
None of these depend on the EV label. They depend on protecting the key and signing every release consistently.
When EV may still be asked for
Some enterprise buyers, driver programs or internal policies name EV in their requirements. If a customer contract or a platform program says EV, buy EV. Ask for the requirement in writing and check what exactly it says, because requirements change.
A simple decision guide
- Do you ship through a store that re-signs your app? Then your own certificate matters less for the end user prompt.
- Does a named customer or program require EV? Then buy EV.
- Neither? Choose the option that gives you the strongest key protection and the easiest automation in your build pipeline.
- Whichever you pick, keep one identity and plan for renewal. Our note on where to keep code signing keys covers storage.
Common mistakes
Buying on the old assumption is the big one. The second is treating the certificate as the whole job. A signature proves who signed and that the file is unchanged. It does not prove the software is safe, a point made vividly by the 3CX signed installer case.
A note on cost and effort
Price is a poor guide here. The cost that bites is operational: a certificate that is hard to use in CI gets worked around, and workarounds are where keys leak. Ask each provider how signing fits your pipeline, what identity checks you must complete, and how long issuance and renewal take. A cheaper certificate that your team can automate safely beats an expensive one that sits on a laptop. Also confirm what happens to your publisher name if you change company details, since identity validation is tied to it.
Quick check
Do OV certificates trigger SmartScreen more than EV?
Per Microsoft, both a valid OV and a valid EV certificate lead to the same first-download behaviour, with a warning until reputation builds.
Should I keep signing if I get warnings anyway?
Yes. Unsigned files start with zero reputation for every version, and signed files can build reputation on a consistent identity.
Sources
Last reviewed: 19 October 2026.
