# Automatically Signing a Windows EXE with Azure Trusted Signing, dotnet sign, and GitHub Actions

DevFeed: [Automatically Signing a Windows EXE with Azure Trusted Signing, dotnet sign, and GitHub Actions](<https://devfeed.tech/articles/automatically-signing-a-windows-exe-with-azure-trusted-signing-dotnet-sign-and-github-actions-21851.md>)

Original publisher: [Read original article](<https://www.hanselman.com/blog/automatically-signing-a-windows-exe-with-azure-trusted-signing-dotnet-sign-and-github-actions>)

Author: Scott Hanselman

Published: 2025-11-28T19:31:25Z

Content type: tutorial

Language: en

Sources: [Scott Hanselman](<https://devfeed.tech/sources/scott-hanselman.md>)

Topics: [Azure](<https://devfeed.tech/topics/azure.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [Windows](<https://devfeed.tech/topics/windows.md>)

Tags: [azure](<https://devfeed.tech/tags/azure.md>), [dotnet](<https://devfeed.tech/tags/dotnet.md>), [dotnetcore](<https://devfeed.tech/tags/dotnetcore.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [signing](<https://devfeed.tech/tags/signing.md>), [windows](<https://devfeed.tech/tags/windows.md>)

## AI overview

A tutorial on signing a Windows executable with Azure Trusted Signing, dotnet sign, and GitHub Actions. It describes cloud-based certificate management, CI/CD integration, prerequisites, and approximate pricing for small projects.

## Source excerpt

Mac Tahoe (in Beta as of the time of this writing) has this new feature called Edge Light that basically puts a bright picture of an Edge Light around your screen and basically uses the power of OLED to give you a virtual ring light. So I was like, why can't we also have nice things? I wrote (vibed, with GitHub Copilot and Claude Sonnet 4.5) a Windows Edge Light App (source code at https://github.com/shanselman/WindowsEdgeLight and you can get the latest release here https://github.com/shanselman/WindowsEdgeLight/releases or the app will check for new releases and autoupdate with Updatum). However, as is with all suss loose executables on the internet, when you run random stuff you'll often get the Window Defender 'new phone, who dis' warning which is scary. After several downloads and no viruses or complaints, my executable will eventually gain reputation with the Windows Defender Smart Screen service, but having a Code Signing Certificate is said to help with that. However, code signing certs are expensive and a hassle to manage and renew. Someone told me that Azure Trusted Signing was somewhat less of a hassle - it's less, but it's still non-trivial. I read this post from Rick (his blog is gold and has been for years) earlier in the year and some of it was super useful and other stuff has been made simpler over time. I wrote 80% of this blog post, but since I just spent an hour getting code signing to work and GitHub Copilot was going through and logging everything I did, I did use Claude 4.5 to help organize some of this. I have reviewed it all and re-written parts I didn't like, so any mistakes are mine. Azure Trusted Signing is Microsoft's cloud-based code signing service that: No hardware tokens - Everything happens in the cloud Automatic certificate management - Certificates are issued and renewed automatically GitHub Actions integration - Sign during your CI/CD pipeline. I used GH Actions. Kinda Affortable - About $10/month for small projects. I would like