How to verify a Windows installer signature with SignTool

To check a Windows installer, run SignTool with the verify command and the default authentication policy, then confirm the publisher and the timestamp. A passing result means the file is unchanged since signing and the certificate chains to a trusted authority. It does not mean the software is safe.

What you need

SignTool ships with the Windows SDK. Microsoft's documentation shows it installed under the SDK bin folder, for example in a versioned x64 directory. You only need it on a machine where you verify, not on every user device. For casual checks, the file Properties dialog, Digital Signatures tab, shows similar details.

The command

Open a terminal and run:

signtool verify /pa /v Installer.exe

The pa option selects the Default Authentication Verification Policy. Microsoft's reference says that without it SignTool uses the Windows Driver Verification Policy, which is not what you want for an ordinary application. The v option prints verbose output, including warnings.

To make a missing timestamp visible, add the tw option, which generates a warning if the signature is not time stamped:

signtool verify /pa /tw /v Installer.exe

SignTool returns 0 on success, 1 on failure and 2 when it finishes with warnings, so scripts can act on the exit code.

Reading the result

Check these items in the verbose output.

1. The signing certificate chains to a root you expect.
2. The subject name matches the publisher you intended to get software from.
3. A timestamp is present.
4. No warnings appear about the signature policy.

According to Microsoft, verify determines whether the certificate was issued by a trusted authority, whether it has been revoked, and, optionally, whether it fits a specific policy.

What a pass does not tell you

A good signature tells you who signed the file and that it was not modified afterwards. It does not tell you the signer's build was clean. The 3CX signed installer incident is the standard warning here. If the publisher is a name you do not recognise, treat even a passing result with suspicion.

Add a second check

Compare the file's hash with the value published by the vendor on a different channel than the download. That gives you a check that does not rely on the certificate system. See checksum versus signature.

Using it in a pipeline

You can add the same command as a final CI step after signing. Fail the job on exit code 1, and treat exit code 2 as a warning to review, especially if it means the timestamp is missing. Run it against the artifact you will upload, not against the build output folder, so you check exactly what users will download. Keep the log with the release record.

Quick check

Sources

• SignTool, Microsoft Learn

Last reviewed: 19 October 2026.