The short answer
Windows shows "Unknown Publisher" when a program has no digital signature it trusts: the file is unsigned, signed with a certificate this computer does not trust, changed after signing, or signed with an expired certificate and no timestamp. It is not proof of malware, but nobody vouched for the file, so run it only from a source you trust. Developers remove it by signing each release with a publicly trusted code signing certificate and a timestamp, though SmartScreen can still call a new signed file unrecognized until it builds reputation.
Which "unknown publisher" warning are you seeing?
Windows has four dialogs that can call a program's publisher unknown or unverified, and they check different things. The User Account Control (UAC) prompt and the older Security Warning for downloaded files ask whether a signature verifies who published the file. SmartScreen's "Windows protected your PC" also weighs download reputation. Smart App Control, on new Windows 11 installs, blocks unsigned code it does not recognise.
| Dialog | When it appears | What a trusted signature changes |
|---|---|---|
| UAC prompt, yellow background | A program asks for administrator rights. Microsoft: yellow means the app is unsigned, or signed but not trusted. | The prompt still asks for permission, but on a gray background, which Microsoft uses for apps signed by a verified publisher. |
| Security Warning, "Unknown Publisher" | A file from an untrusted source (it carries the Mark of the Web) has no signature that verifies its publisher. | The file now has a signature that verifies its publisher, which is what the warning says is missing. |
| SmartScreen, "Windows protected your PC" | A downloaded file, or its publisher, has no download reputation yet. Unsigned and self-signed files get the same treatment. | The publisher name is displayed, but a new file can still be flagged as unrecognized until reputation builds. |
| Smart App Control (new Windows 11 installs) | Smart App Control is on and the file is neither recognised by Microsoft's app intelligence service nor signed with a trusted certificate. | Allowed, if the certificate comes from a CA in Microsoft's Trusted Root Program. |
If you are about to run someone else's program, the next section is for you. If you publish the program, the warning is about your file, and the fix is on your side: sign each release with a code signing certificate from a CA that Windows trusts. My-SSL sells Certum code signing certificates, including the ones this page discusses.
Is it safe to run a program from an unknown publisher?
An "Unknown Publisher" warning does not mean a program is malware. It means Windows has no verified name to hold responsible for the file, so the decision is yours. Run the program only if you know where it came from, such as the developer's own download page, and after a quick look at its signature. Microsoft's advice for SmartScreen warnings is to proceed only after verifying the source.
Checking a file takes under a minute:
- Right-click the file, choose Properties, and open the Digital Signatures tab. No tab means the file is not signed.
- Select the signature, click Details. A valid signature reads "This digital signature is OK." Check that the signer's name is the company or person you expected.
- Or, in PowerShell, run
Get-AuthenticodeSignature -FilePath .\setup.exe. A Status ofValidmeans the signature checks out; an unsigned file comes back with the signer fields blank. Our guide to verifying a code signature covers more tools.
If the signature is missing and you still trust the source, answer the dialog for that one file: Yes in the UAC prompt, or More info and then Run anyway in SmartScreen (an employer's policy can remove that choice). Advice to switch UAC or SmartScreen off for the whole computer is common in the top search results. It silences the check for every file you open afterwards, not just this one.
What triggers the warning on a developer's file?
A developer's program triggers the "Unknown Publisher" warning when Windows cannot connect the file to a publisher it trusts. Microsoft's UAC documentation names two cases: the app is unsigned, or it is signed but not trusted. In practice that comes down to four causes, and only the first is fixed by adding a signing step.
- No signature. The build never ran a signing step. Common for first releases and in-house tools.
- An untrusted certificate. The file is signed, but with a self-signed or private certificate that other computers have no reason to trust.
- A file changed after signing. Patching, repacking or adding a resource after the signature breaks its hash.
- An expired certificate without a timestamp. Microsoft says that without a timestamp the signature becomes invalid when the certificate expires and Windows treats the binary as unsigned.
What did we see when we signed a test EXE?
On October 15, 2026 we built a small Windows console program and checked it on Linux with osslsigncode 2.8, an open-source Authenticode tool. We tested three of the four causes above: no signature, a self-signed certificate, and a file changed after signing, with a Certum timestamp on the signature. No Windows dialog was involved: the trust decision comes from the root file we gave the verifier.
# 1. Unsigned EXE
$ osslsigncode verify -in hello.exe
No signature found
Failed
# 2. Sign with a self-signed certificate, SHA-256, RFC 3161 timestamp
$ osslsigncode sign -certs cert.pem -key key.pem -h sha256 \
-ts http://time.certum.pl -in hello.exe -out hello-signed.exe
Succeeded
# 3. Verify against an ordinary root store
$ osslsigncode verify -in hello-signed.exe -CAfile /etc/ssl/certs/ca-certificates.crt
Verify error: self-signed certificate
Signature verification: failed
# 4. Verify after telling the verifier to trust our own certificate
$ osslsigncode verify -in hello-signed.exe -CAfile cert.pem \
-TSA-CAfile /etc/ssl/certs/ca-certificates.crt
Timestamp time: Oct 15 08:51:26 2026 GMT
Issuer: /C=PL/O=Asseco Data Systems S.A./CN=Certum Timestamping 2021 CA
Signature verification: ok
# 5. Change one byte after signing
$ osslsigncode verify -in hello-tampered.exe -CAfile cert.pem
Current message digest : 9AC8FE09C5739A3A473663248A65E58E075470FD167E2DD25EE136AED36A81AD
Calculated message digest : FF3435A2080611BA08E6C2334E60EC4203C25D4CCF68F083C82859909B28C48D MISMATCH!!!
Signature verification: failedSteps 3 and 4 are the same file with the same signature. It passed only where we installed our own certificate as trusted. That is the catch with a self-signed certificate: it is trusted only on machines where you install it. Step 5 shows why signing has to be the last step of the build. One changed byte, and the hash no longer matches the signature.
How does a code signing certificate fix it?
A code signing certificate fixes the "Unknown Publisher" warning by giving Windows a verifiable publisher. You sign the file with a key whose certificate a public CA issued after checking who you are. Windows recomputes the file's hash, checks the signature, and follows the certificate to a root it trusts. When all of that holds, the UAC prompt turns gray, the colour Microsoft uses for apps signed by a verified publisher.
Where the key lives has changed. Since June 1, 2023, the CA/Browser Forum's code signing rules require the private key to be generated, stored and used in a hardware crypto module, so a modern certificate does not arrive as a .pfx file you can copy around. Certum's SimplySign keeps the key on a virtual card in Certum's cloud: the SimplySign mobile app generates the access code and SimplySign Desktop connects your PC to it. My-SSL delivers both its Standard and EV code signing certificates through SimplySign, with no USB token shipped.
The signing command itself is short. Our SignTool guide covers it on Windows, and signing an EXE on Linux covers osslsigncode.
How is "Unknown Publisher" different from the SmartScreen warning?
"Unknown Publisher" is about identity: is the file signed by someone Windows can verify? SmartScreen's "Windows protected your PC" is about reputation as well: Microsoft says it weighs both the publisher's certificate and the hash of the exact file. A certificate settles the identity question the moment you sign. Reputation builds as people download and run the file, which Microsoft says can take several weeks and hundreds of clean installs.
Signing still helps with SmartScreen. Microsoft's developer guidance says reputation can build on the certificate and carry over to new files signed with it, while an unsigned program starts from zero with every version. Keep the same signing identity across releases for that reason. There is no form to submit a file for consumer SmartScreen review. Our guide to how SmartScreen publisher reputation works goes further.
Why can the warning still appear after you sign?
A signed file still shows "Unknown Publisher" when one of the four checks fails, and the verifier usually says which. On Windows, run signtool verify /pa /v setup.exe: /pa applies the Default Authentication Verification Policy used for code signing (without it SignTool checks against the driver policy) and /v prints the signer certificate.
- The chain stops short. The intermediate certificate that links yours to the root was not included, so Windows may not be able to reach a trusted root. The same class of problem as a broken SSL certificate chain.
- The certificate expired and the signature had no timestamp. A timestamp from a trusted timestamp authority keeps the signature verifiable after expiry. Our timestamping guide explains the options.
- Something changed the file after signing. An installer builder, a packer or a post-build script ran after the signing step. Sign last.
- It was signed with a test certificate. A self-signed or internal CA certificate left in the release pipeline passes on the build machine and fails everywhere else.
If the signature verifies and the warning is SmartScreen's rather than UAC's, see why a signed EXE can still be flagged.
Which certificate do you need to remove the warning?
Any publicly trusted code signing certificate moves the UAC prompt from yellow to gray, so the choice between Standard (OV) and EV comes down to who you are. Certum issues Standard certificates to an individual or a company, and EV only to registered companies. If you publish under your own name, our guide to code signing for individual developers covers what the dialog will show.
Do not buy EV to skip SmartScreen. Microsoft's SmartScreen documentation now says EV certificates no longer bypass it and no longer affect its behaviour, and that paying a premium for EV only for that reason is no longer justified. EV still means stricter organization vetting. Compare the two on the EV code signing page, or read our code signing certificates explainer.
Updated October 15, 2026: new sections on telling the four Windows dialogs apart, checking a file's signature before you run it, and Smart App Control; a signing test with osslsigncode; Microsoft's current wording on UAC colours and on EV and SmartScreen (the old page gave a date for the EV change that Microsoft does not state); the unsourced SHA-1 rule was removed.
Frequently Asked Questions
Answers to common questions about certificates and our services.
What does the 'Unknown Publisher' warning mean?
Windows could not tie the program to a publisher it trusts. Either the file has no digital signature, or it has one Windows will not accept: made with a certificate this computer does not trust (a self-signed one, for example), changed after signing, or past the certificate's expiry with no timestamp. Microsoft's UAC documentation puts it as an app that is unsigned, or signed but not trusted.
Is it safe to run a program from an unknown publisher?
Not by default. The warning does not say the file is malware; it says nobody verified who made it. Run it only if you got it from the developer's own site or another source you trust, and check the file first: right-click, Properties, Digital Signatures. If there is no such tab, the file is unsigned. Microsoft's advice for the SmartScreen version of the warning is to proceed only after verifying the source.
How do I allow an app from an unknown publisher in Windows 11?
For a program you trust, answer the prompt: choose Yes in the UAC dialog, or More info and then Run anyway in the SmartScreen dialog. Microsoft notes that enterprise policy can remove the Run anyway choice. Turning UAC or SmartScreen off for the whole computer is not a fix: it removes the check for every other file too.
How do developers get rid of the 'Unknown Publisher' warning?
Sign the program with a code signing certificate from a CA that Windows trusts, use SHA-256, and add an RFC 3161 timestamp. The UAC prompt then turns gray, the colour Microsoft uses for apps signed by a verified publisher. SmartScreen shows the publisher name, but it can still call a new file unrecognized until the file and the certificate build download reputation.
Does an EV code signing certificate remove the warning faster?
For the UAC prompt, no: a Standard (OV) and an EV certificate both turn the UAC prompt gray, the colour Microsoft uses for apps signed by a verified publisher, as soon as the file is signed. For SmartScreen, Microsoft's developer documentation says EV certificates no longer bypass SmartScreen and no longer affect its behaviour. Choose EV for its organization vetting, not as a shortcut past SmartScreen.
Can I fix it with a self-signed certificate?
Only on computers where you install that certificate yourself. Microsoft's SmartScreen table gives a self-signed file the same behaviour as an unsigned one. In our test, the same self-signed EXE failed verification against a normal root store and passed only when we told the verifier to trust our own certificate.
The bottom line
If you see the warning, check the file's signature and run it only from a source you trust. If your software causes it, sign every release as the last build step with a publicly trusted certificate and a timestamp, then let SmartScreen reputation build on that same certificate. My-SSL's Standard and EV code signing certificates are issued by Certum and delivered through SimplySign.