If you ship an Electron app without code-signing, this is what users see:
- macOS — "App can't be opened because it is from an unidentified developer." Auto-update is broken.
- Windows — "Microsoft Defender SmartScreen prevented an unrecognized app from starting." Users see a scary blue screen.
Both go away once you sign. The boilerplate has the scripts already — you just need certificates.
What it costs
| Platform | What you need | Cost |
|---|---|---|
| Windows | Authenticode certificate from a CA (SSL.com, DigiCert, Sectigo) | ~$200/year |
| macOS | Apple Developer Program membership | $99/year |
These are unavoidable — both Microsoft and Apple require certs from approved authorities.
Windows: Authenticode
1. Buy a cert
Pick any provider — SSL.com and SignMyCode are reasonable starting points. EV certs (~$400/yr) are pricier but earn instant SmartScreen reputation; standard certs build reputation slowly.
2. Export to a .pfx file
You'll receive a certificate. Export it from the Windows cert store to a .pfx file with a password.
3. Wire env vars
export CSC_LINK="/absolute/path/to/cert.pfx"
export CSC_KEY_PASSWORD="your-pfx-password"Then:
npm run build:winelectron-builder picks the cert up automatically and signs the installer.
macOS: signing + notarization
1. Join the Apple Developer Program
developer.apple.com/programs/ — $99/year.
2. Create a Developer ID Application certificate
In Xcode: Settings → Accounts → Manage Certificates → + → Developer ID Application. This is the one that lets you ship outside the App Store.
3. Create an app-specific password
At appleid.apple.com → App-Specific Passwords → generate one. Save it somewhere safe.
4. Wire env vars
export APPLE_ID="[email protected]"
export APPLE_APP_SPECIFIC_PASSWORD="xxxx-xxxx-xxxx-xxxx"
export APPLE_TEAM_ID="ABCDE12345" # find in Apple Developer portalThen:
npm run build:macThe build signs and notarizes (sends the binary to Apple, gets a notarization ticket, staples it). Takes ~5 minutes total because notarization waits on Apple's servers.
Common notarization failure
"Notarization failed: hardened runtime required." If you see this, check build/entitlements.mac.plist exists and electron-builder.yml has hardenedRuntime: true. Both should already be set in the boilerplate — don't remove them.
Ask your AI assistant
"My macOS notarization is failing with [paste the exact error]. Read build/entitlements.mac.plist and electron-builder.yml, then tell me what's likely wrong."
What's next
- Wire AI features → AI integration with Claude + OpenAI