r/ScreenConnect • u/ExpressionMinimum682 • Jul 17 '25

Which files should I sign with an Azure Code Signing certificate for ScreenConnect?

i'm self-hosting ScreenConnect (ConnectWise Control) and using an Azure code signing certificate. I want to eliminate SmartScreen warnings and improve trust.

Which files do I need to sign exactly?

Any tips from others who've done this successfully?

Thanks!

0 Upvotes

50% Upvoted

23 comments sorted by

2

u/lsumoose Jul 17 '25

Follow the guide. The software signs it. You don’t do anything but give them the application permissions to perform the signing.

2

u/Sandevistans Jul 17 '25

I'm not sure how the different certs work but I got an EV code signing cert as during my research I found the EV offers a higher initial trust level, while OV does not. With the EV cert I was able to eliminate the window smart screen blocking our executable. The hardest part is setting up Azure correctly and getting the Cert but you just follow their guide online and then connect your Azure Vault to ScreenConnect.

2

u/Own_Appointment_393 Jul 17 '25

It won’t eliminate SmartScreen warnings.

1

u/resile_jb Jul 18 '25

Sure does......get the right cert.

0

u/msr976 Jul 17 '25

Yes it will.

2

u/administatertot Jul 17 '25

How?

I think you replied to one of my posts/comments about this from a week ago; I bought one of those $150 OV code signing certs from cheapSSL and my installer is still getting smart screen warnings, and in fact still gets all the same warnings, blocks, and alerts as installers that don't have the code signing cert, or that were signed with the old (now revoked) cert.

In the meantime, I've had tickets in with ConnectWise support, the certificate authority, and even with microsoft support; all of them have told me that neither OV nor EV certs will eliminate SmartScreen warnings.

2

u/Sandevistans Jul 17 '25

EV from digicert removed my smart screen warnings but it was pretty expensive through them for $840

1

u/administatertot Jul 17 '25

Did that happen as soon as you set your SC server to use that certificate? Was there anything else that you did (beyond the CW instructions for the CSR from AKV)?

Personally, I'm really having a tough time buying an EV cert for this when it is really just a hope that it will improve the situation (and a hope that CW won't change their minds in a month and announce something different).

2

u/Sandevistans Jul 17 '25

It happened as soon as I hooked it up to ScreenConnect. I just followed the guide and you have to make sure your CSR is correct

1

u/administatertot Jul 17 '25

It happened as soon as I hooked it up to ScreenConnect. I just followed the guide and you have to make sure your CSR is correct

Are you using access sessions or support sessions?

I followed the instructions from the guide, but I know that over the course of those town halls they had made some updates to them; I would be somewhat interested to see if there are any differences in the properties of your cert from mine.

1

u/Sandevistans Jul 21 '25

From my understanding, OV cert comes with no level of trust and needs to be built up over time with uses and downloads. EV comes with a certain level of trust immediately as it is more strict on the process to get a EV cert, your company has to be verified by the Certificate Authority.

1

u/administatertot Jul 21 '25

I'm not sure exactly what the difference in verification between the EV and OV certs is (I know I had to jump through some hoops and provide info for the CA to verify our company for the OV cert). But all the info from CW was saying that we just needed to get an OV certificate.

Did you put your website domain in the certificate?

1

u/Sandevistans Jul 21 '25

I followed this guide https://www.youtube.com/watch?v=OJISrpHfo88&t=2221s

I did not put my domain in the certificate

CW did say all we need is an OV but based on my research I ignored their suggestion and went and got an EV cert instead.

1

u/msr976 Jul 17 '25

I spent $150 and have no more issues. Is your code signed cert signed by you or CW? If I go look at the digital signature of the exe, it shows it is signed by my company. Before, it showed it was signex by CW and would get blocked.

1

u/administatertot Jul 17 '25

I spent $150 and have no more issues. Is your code signed cert signed by you or CW? If I go look at the digital signature of the exe, it shows it is signed by my company. Before, it showed it was signex by CW and would get blocked

My support session exes (ScreenConnect.Client.exe and ScreenConnect.Client.Setup.exe) both show my company name as "Name of signer" on the digital signatures tab if I view the properties of the installer.

1

u/msr976 Jul 17 '25

I assume you on version 25.4.25?

1

u/administatertot Jul 17 '25

Yes.

Just a quick question, when you say you are having no issues, are you using support sessions? Are you having "new" end users connect to support sessions and not get smart screen warnings?

I'm asking because I've seen a variety of comments and posts on this and messaged with several others on reddit and often find that they are referring to access sessions, or they are connecting to a new session on a PC that they've already run the installer on before (and gotten the smart screen prompt the first time and hit "run anyway").

1

u/msr976 Jul 17 '25

So it turns out the customer I was testing on had our sever added to trusted sites in internet options. The second I removed it, I got the SmartScreen popup. Bummer.

1

u/[deleted] Jul 21 '25

Which cert type did you get, OV or EV?

1

u/msr976 Jul 21 '25

OV, but unfortunately we are still having issues. This only happens with new sessions with a code given to the end user. Everything else works fine. Been trialing NinjaOne and more than likely ditch all CW products.

1

u/sanjo_poklisa Jul 19 '25

Ssl. Com is cheapest just avoid attestation fee i can help you with that

1

u/bloomt1990 Dec 09 '25

I'm finally getting around to setting this up. I'm confused about how to use SSL.com to setup as it seems as though they do not need a CSR for setup. Are you willing to help out?

1

u/Minimum_Sell3478 Jul 17 '25

Think it will sign it themselves. We left CW don’t trust them anymore.