How to pass the smart screen on Win8 when install a signed application?

Question

We are developer, and we have a digital signed application installer. When we install this application, it popups out the smart screen which affects the installing experience. It says

Windows protected your PC

Windows SmartScreen prevented an unrecognized app from starting, Running this app might put your PC at risk.

I think Microsoft has some strategy to verify the application besides the digital signature. Has anyone has the experience for this issue and please give me some clue to fix this issue?

Answer 1

We just went through the whole process of moving from an old Authenticode certificate to a new one (not an EV certificate, just a plain certificate that can be used in our automated build process).

Microsoft is no longer providing any means of transferring reputation from an existing certificate to a new one. So don't try to call their support. You'll just waste a lot of time and energy. And they won't be able to help.

Microsoft is claiming that if the old and new certificates have the same textual content, the reputation gets established faster. More specifically, here is the reply I got from the SmartScreen® Filter's Application Reputation feature support team:

Please note that whenever you renew a certificate with known reputation, you will likely see some warns during initial downloads of files signed with the renewed certificate. However, known reputation on the renewed certificate is typically established more rapidly than on a new certificate. While a renewed certificate establishes reputation, users can still click through to run or save the download. To do so, they select Actions | More Options | Run Anyway from Download Manager.

The best way to ensure that SmartScreen won't warn the users is to run the Windows App Certification Kit (WACK) which should be included in the Windows SDK download:

After running the tests, WACK explains how to proceed:

Upload the XML result of a successfull application certification to https://sysdev.microsoft.com. A few days later, SmartScreen will be aware of the digital signature used for the certified program and will no longer warn the users on download.

Note We were not able to certify our application on the latest updates of Windows 8.1 and we had to use a clean install of Windows 8.1 in order to get WACK to validate successfully all of our programs.