Why Do Programs Still Show an "Unsafe" Warning After Being Signed with an SSL Code Signing Certificate?

Problem Background

Previously, EV code signing certificates could directly eliminate security warnings from Microsoft SmartScreen. However, Microsoft has now adjusted the relevant mechanism: even programs signed with an EV code signing certificate may still trigger a warning prompt from Microsoft Defender SmartScreen.

Microsoft Reputation Assessment Mechanism

Microsoft has rolled out a new update. SmartScreen's reputation assessment is no longer based solely on certificate type, but is instead determined by comprehensive reputation indicators such as software usage and download volume:

• Newly signed programs: Regardless of whether an EV or OV code signing certificate is used, a SmartScreen warning may be triggered upon initial release.
• Reputation accumulation process: After a program accumulates sufficient downloads and user trust, the SmartScreen warning will gradually disappear.
• Difference between EV and OV: In Microsoft's trust algorithm, EV code signing carries a higher weight than OV code signing, so the number of downloads that EV code signing needs to accumulate is far less than that required for OV code signing.

It should be noted that this phenomenon is entirely controlled by Microsoft and is not an issue with the certificate itself. Although EV certificates still provide the highest level of validation and security assurance, they can no longer guarantee the automatic elimination of SmartScreen warnings as they did in the past.

References

For details, see Microsoft's official documentation: SmartScreen reputation assessment mechanism