How to Verify a Code Signature
Check whether software was signed by a particular identity, whether signed content has changed, and whether certificate trust or timestamp issues could affect acceptance. Use verification tools that match your software platform.
What Does Code Signature Verification Check?
A signature check is more than confirming that a signature exists. A complete review considers integrity, signer identity, certificate trust, timestamp information, and the platform's security requirements.
Signature integrity
Checks whether the signed content matches the signature and whether it has changed.
Signer identity
Identifies the certificate associated with the software publisher.
Certificate chain and validity
Reviews whether the signing certificate chains to a trusted authority and can be validated under applicable rules.
Timestamp and revocation
Checks timestamp evidence and revocation information where supported by the tool and configuration.
How to Verify a Code Signature on Windows
Windows provides SignTool, a command line utility included in the Windows SDK. It can verify Authenticode signatures and report information about the signing certificate.
Step 1: Open a terminal
Open Command Prompt or PowerShell where SignTool is available. Confirm that signtool.exe is installed and accessible through your system path.
Step 2: Verify the signed file
signtool verify /pa /v "MyApplication.exe"Replace the example filename with your file path. /pa applies the default Authenticode verification policy and /v displays detailed output. Without /pa, SignTool uses the Windows driver verification policy by default.
Step 3: Review the result
Check verification status, signer information, chain or trust errors, and warnings. SignTool returns exit code 0 for success, 1 for failure, and 2 when verification completes with warnings.
How to Verify a Code Signature From the Command Line
Command line verification is useful for developers, system administrators, and release engineers who need to check signatures repeatedly or automate checks.
Windows Authenticode
signtool verify /pa /v "release.exe"Catalog related options may be needed depending on the file and signature arrangement.
Java archives
jarsigner -verify -verbose -certs MyApplication.jarChecks signature information and signed archive entries.
macOS applications
codesign --verify --deep --strict --verbose=2 "MyApp.app"Checks the application's code signature under Apple's code signing system.
Platform rules differ
A successful result on one platform is not equivalent to verification on another.
How to Verify a Java JAR Signature
Java provides jarsigner to verify signatures on JAR files. It checks signature information and the integrity of signed archive entries.
jarsigner -verify -verbose -certs MyApplication.jarThe output can show which archive entries are signed and provide certificate information. A message such as jar verified indicates that JAR signature verification succeeded, but review warnings about certificates, algorithms, or trust. A technically valid JAR signature does not automatically mean every Java runtime or application will trust the signer.
Java archive verification checks the signed entries in the final package; the JAR signing workflow covers keystore selection and signature creation before those checks take place.
How to Verify a macOS Application Signature
macOS uses Apple's code signing system. The codesign utility checks application integrity and relevant code signature requirements.
codesign --verify --deep --strict --verbose=2 "MyApp.app"Review output for messages indicating that the application is valid on disk and satisfies its designated requirement.
Assess Gatekeeper acceptance
For applications distributed outside the Mac App Store, assess acceptance under Gatekeeper policies:
spctl --assess --type execute --verbose "MyApp.app"Signature verification and Gatekeeper assessment are different checks. The first examines the code signature; the second evaluates the applicable system security assessment. The macOS signing and notarization workflow prepares an application for distribution and these release checks.
How to Check the Signer Certificate
After verifying a signature, inspect the certificate to understand who signed the software and how it is trusted.
| Certificate detail | What it tells you |
|---|---|
| Subject or publisher | The identity associated with the signing certificate. |
| Issuer | The certificate authority that issued it. |
| Validity period | The certificate's not before and not after dates. |
| Certificate chain | How the signing certificate links to a trusted root. |
| Timestamp | Evidence of when the signature was created, if present. |
| Revocation status | Whether the certificate has been revoked, where checked. |
On Windows, use SignTool's detailed output or right click the file, open Properties, and inspect the Digital Signatures tab when available. The presence of a certificate does not prove that a file is safe.
How to Verify a Code Signing Timestamp
A timestamp provides evidence of when a signature was created. It can help establish that software was signed while its certificate was valid, subject to applicable trust and revocation rules.
signtool verify /pa /v "MyApplication.exe"Inspect the detailed output for timestamp information and validation warnings. A successful signing command does not by itself confirm that a timestamp can be validated. The software timestamping process adds trusted time evidence that can then be checked during verification.
What Does an Invalid Code Signature Mean?
An invalid signature means the verification process could not establish the expected signature validity. Identify the cause before deciding what to do next.
File changed after signing
Modifying signed content can invalidate its signature.
Signature missing or damaged
The file may not have been signed correctly or its signature data may be incomplete.
Certificate chain not trusted
The signing certificate or an intermediate may be missing or untrusted.
Certificate expired or revoked
Validity and revocation can affect trust, depending on timestamps and policy.
Incorrect verification policy
The tool may be checking under a policy that does not match the intended software or driver scenario.
Timestamp cannot be validated
Timestamp certificate or trust problems can affect the result.
When verification fails, investigate the reported error before rebuilding or resigning the file. The code signing error troubleshooting process helps distinguish content changes from certificate, trust, and timestamp problems.
Can a Signed File Still Be Unsafe?
Yes. A valid signature helps establish signer identity and detect changes to signed content, but it does not prove software is free of vulnerabilities, malicious behavior, or unwanted functionality.
Before executing unfamiliar software, consider whether you recognize the publisher, whether the file came from the expected distribution channel, whether the signature is valid under the relevant platform policy, whether the software came from an authentic source, and whether security tools identify risks.
Choose a signing certificate for your release
After verifying the signing requirements for your platform, compare certificate options based on your software, publisher identity, and distribution needs.
Code Signature Verification Checklist
Use this checklist when checking a signed release.
Frequently Asked Questions
How do I verify a code signature?
Use a tool for the software format. For Windows Authenticode, run signtool verify /pa /v "MyApplication.exe". For Java JAR files, use jarsigner -verify. For macOS applications, use codesign --verify.
How do I know if a code signature is valid?
Check the verification result and warnings. Review signature integrity, signer identity, certificate trust, and relevant timestamp or revocation information.
Can I verify a code signature without running the software?
Yes. Verification tools inspect the file and its signature without executing the application.
Does a valid code signature mean the software is safe?
No. A valid signature helps establish the signer and detect changes to signed content. It does not guarantee that software is free from malware or vulnerabilities.
Can I verify a code signature after the certificate expires?
Potentially. A properly timestamped signature can remain verifiable after certificate expiration, subject to certificate trust, revocation, and platform specific rules.
How do I verify a Windows EXE file?
Use SignTool: signtool verify /pa /v "MyApplication.exe". Review the result and warnings, not just whether a signature exists.
How do I verify a signature from a command line?
Use the platform tool: SignTool for Windows, jarsigner for Java archives, and codesign for macOS code.
What should I do if signature verification fails?
Check whether the file changed after signing, whether the certificate chain is trusted, whether the verification policy is appropriate, and whether certificate or timestamp validation produced errors.
Related Code Signing Guides
Continue with platform specific verification, timestamping, signing, and troubleshooting instructions.
Verify the signature before trusting the release
Check the signer, integrity, certificate trust, timestamp, and platform policy before accepting signed software.