A digital signature guarantees the authenticity of an electronic document or message in an electronic format. In the software industry, code signing provides an added layer of security and trust that you're using a code that comes from an original vendor and not a third-party that could have maliciously altered the code.

In 2018, MSIX was announced by Microsoft as the new universal package format for Windows 10 apps with the later support on desktop, mobile, and other Windows 10 devices.

Digitally signing your application is not only mandatory, it is an essential step to making your software secure and trustworthy.

While for MSIs, this was an optional step, signing your MSIX package is mandatory. Microsoft’s MSIX technology requires the use of code signing certificates to deploy packages.

Many of us are aware of the importance of securing our applications and how digital signatures are a solid way to avoid security breaches. For those looking into MSIX, you must know that Microsoft enforces digital signature for all packages within this technology. There is no exception.

With the experience of unfortunate security breaches in recent years, the focus of making safe and reliable applications has increased in the software industry. This is why adding a digital signature to your application has become a must -- and for MSIX applications it is mandatory.

Digital signing is an important stage of an application packaging cycle and can be achieved by code signing your own software’s certificates. By digitally signing your software, you prove your application’s authenticity and integrity upon installation and guarantee that the software you developed hasn’t been compromised or corrupted.

Starting with January 1st, 2016 Microsoft is implementing a mandatory update of the Digital Signature system from SHA-1 to SHA-2 in order to deal with the decreasing security of the SHA-1 digital signatures. A limited dual-signing system is supported for backwards compatibility.