## Media File Wizard: Code Signing |

| In this step of the media file wizard you can optionally configure code signing for all generated executables. Code-signing ensures that the installer as well as the uninstaller are trusted executables on Windows Vista. For unsigned applications that require admin privileges, Window Vista will display a special warning dialog. Also, Windows XP users who use Internet Explorer receive a different warning dialog when trying to execute a downloaded installer.

| The install4j compiler can invoke a post-processor for each executable that is generated. This includes generated launchers the installer the uninstaller In the post processor text field you can use the `$EXECUTABLE` variable to reference the executable that is currently being post-processed. The working directory of the executed process is the directory your config is located in so you can use relative filenames for key or certificate files. If the signing command cannot replace the executable directly, but rather needs a separate output file, use the `$OUTFILE` variable. It will receive a temporary output file name that will be moved back to the processed executable by install4j after the post processor has completed.

| If you run the build on Windows, you can use the Authenticode tools from the Windows SDK to sign the executable. Older Platform SDKs as well as the .NET v1 SDKs contain the tool signcode.exe. The newer SDKs contain the tool signtool.exe. Both tools are equally suited for code signing with install4j. Please refer to the MSDN documentation for detailed information.

| It is also possible to sign executables on other platforms. The `$INSTALL4J_HOME/resource/signcode.exe` executable is a mono executable modified by ej-technologies to support signing of 64-bit executables. This executable can only be executed if mono is installed. Mono is available for a number of platforms and can be downloaded free of charge. The tool has the same syntax as the one from Microsoft. A typical entry would be `mono /opt/install4j/resource/signcode.exe -spc mycert.spc -v mykey.pvk -vp password -t http://timestamp.verisign.com/scripts/timstamp.dll $EXECUTABLE` Some SPC files cannot be read directly by this tool. If this is the case for your certificate, you can export all CER files from the SPC file and generate a new SPC file with the `cert2spc` tool included with mono. You have to add the CER files in the order of the certificate chain (your own certificate is the last one on the command line).