Azure Trusted Signing: still seeing SmartScreen warnings from new intermediate CAs

SmartScreen warnings for newly signed installers are expected behavior until the file and its signing certificate establish sufficient reputation, even when using Trusted Signing and valid Microsoft issuing CAs.

From the available information:

1. Windows now requires Trusted Signing for /INTEGRITYCHECK-linked user-mode PE files
   • For user-mode PE files built with the /INTEGRITYCHECK linker option, Windows requires them to be signed with Trusted Signing (formerly Azure Code Signing).
   • The legacy cross-signing program is deprecated; no new cross-signing certificates are issued, though existing binaries signed under that program remain trusted.
   • This affects how new binaries are signed and trusted at the OS level, but it does not bypass SmartScreen’s reputation-based checks.
2. SmartScreen uses reputation, not only CA trust
   • Microsoft Defender SmartScreen evaluates both the URL and the app’s digital signature to determine reputation.
   • Even if the certificate chain is valid and issued by a Microsoft intermediate CA, a newly issued intermediate or a newly signed file can still trigger SmartScreen warnings until enough telemetry and usage data build a positive reputation.
   • SmartScreen warnings therefore can still appear for:
     • New installers signed with a new intermediate CA.
     • Low-prevalence binaries, even if correctly signed.
3. SHA-2 and certificate validity vs. SmartScreen
   • Microsoft has moved to SHA-2 exclusively for code signing and related operations.
   • A file being SHA-2 signed and chained to a trusted root/intermediate ensures cryptographic validity but does not guarantee SmartScreen reputation.
   • If the signature is valid (for example, shows SHA256 in the Digital Signatures tab), any remaining warnings are due to SmartScreen reputation rather than a basic trust failure.
4. Practical implications for new Trusted Signing intermediates
   • When Microsoft introduces or rotates issuing CAs (including for Trusted Signing), Windows trusts them for signature validation, but SmartScreen still applies its reputation model.
   • As a result, installers signed with a new intermediate CA can continue to show SmartScreen warnings until:
     • The certificate and binaries gain sufficient reputation, and
     • SmartScreen’s telemetry recognizes them as low risk.
5. What can be done
   • Ensure all binaries are:
     • Signed with Trusted Signing as required (especially for /INTEGRITYCHECK scenarios).
     • SHA-2 (SHA256) signed and chaining correctly to the Microsoft Trusted Signing hierarchy.
   • Distribute the installer through normal channels so that usage and telemetry can build reputation over time.
   • Avoid disabling SmartScreen or other protections; Microsoft does not recommend bypassing security features to work around reputation warnings.

The behavior described (SmartScreen warnings despite valid signatures from current Microsoft issuing CAs) is therefore consistent with SmartScreen’s reputation-based design and not addressed solely by the CA or signing changes.

References:

• KB5022661—Windows support for the Trusted Signing (formerly Azure Code Signing) program
• Microsoft Defender SmartScreen
• KB5003341: Issues you might encounter when SHA-1 Trusted Root Certificate Authority expires