Any plans to support EV Code Signing Certificates? They are getting to be a requirement for software distribution since they bypass the SmartScreen reputation building phase. Seems like newer versions of Windows 10 are more particular about programs without EV Code Signing. Our solution is to pre-sign all the executables and post sign the MSI file after InstallShield creates it. Using the security token does not seem to work with InstallShield as there does not seem to be any way to pass all the required signtool parameters. I'm not even sure if InstallShield uses signtool anymore, but it would be nice if we could simply pass in a signtool command line like Visual Studio allows. ... View more

To get SHA256 time stamps I changed the settings.xml file timestamp entries to look like this: so that the time stamps would be SHA256. This works on the MSI and EXE files that get built by InstallShield. These files show an SHA256 time stamp. Symantec SHA256 TimeStamping Signer - G1 However, unsigned EXE files embedded in the MSI and EXE installers that I have InstallShield sign via the Releases signing tab, Include patterns and files option still get timestamped with an SHA1 signature: Symantec Time Stamping Services Signer - G4 It is still unclear to me the importance of having SHA256 time stamps. So far, I have not seen it addressed in any of the Microsoft sky is falling SHA256 documents, but it would be nice if there was a way to make this work for EXE files signed via the Patterns and Files option. ... View more

I am able to sign and timestamp my own exe files using signtool with my new sha256 verisign authenticode certificate. The signature works fine from windows 7 to 10. Both the signature and timestamp use sha256. However, I am unable to get the InstallShield 2015 to properly timestamp my MSI installer. By default it uses the non-sha256 timestamper supplied by verisign. If I edit the settings.XML file to use the same sha-256 compliant timestamper that I use on my exe files (http://timestamp.entrust.net/TSS/RFC3161sha2TS), the time stamp gets left out of the MSI file. So I end up with a signed MSI file that has no timestamp. I suppose this is not surprising since the settings.xml file does not let you specify any of the required signtool parameters when you switch to sha256. Is there any chance the InstallShield 2015 will be updated to fully support sha256 certificates and sha256 timestamping? My main reason for using InstallShield 2015 was to be ready for Microsoft's forced sha256 authenticode requirements. ... View more