SmartScreen always flags my installer after subscription renewal, even though it is correctly signed

Question

SmartScreen always flags my installer after subscription renewal, even though it is correctly signed

Taylor Kerr 20

I am looking for help with Microsoft Defender SmartScreen reputation behavior for my signed installer.

Problem:

My installer used to launch without SmartScreen warnings. After a temporary subscription payment lapse and later renewal, SmartScreen now flags the installer every time. This has continued for weeks.

Additional behavior that seems important:

Immediately after build/signing on my machine, the installer runs with no SmartScreen warning. It also runs with no issue before signing while local. However, after the same installer is downloaded from GitHub, it is flagged by SmartScreen, even though the digital signature remains present and valid.

Current status:

The installer is being signed.
The digital signature is present and valid.
The signing account/subscription is active on my machine.
SmartScreen still shows "Windows protected your PC" consistently after GitHub download.
Local Antivirus version is up to date and the file itself has been updated with the most current signature on GitHub
Other users across the web are also having the installer flagged in the exact same way

Signing scripts (so you can review exactly how signing is done):

Installer script: https://github.com/salty5844/salty-spittoon-modpack/blob/main/installer.nsi
Signer script: https://github.com/salty5844/salty-spittoon-modpack/blob/main/signer.nsi

How can I restore my signature trust/reputation? This is the primary reason I pay for Azure code signing.

User's image

Taylor Kerr 20 Reputation points

2026-07-16T23:00:19.68+00:00

EDIT: File was submitted to Microsoft for an Incorrect Detection and they responded with instructions that are not possible as the warning page does not have an option to "Report this file as safe"

Answer accepted by question author

0 additional answers

Your answer

Taylor Kerr 20 Reputation points

2026-07-16T23:00:19.68+00:00

EDIT: File was submitted to Microsoft for an Incorrect Detection and they responded with instructions that are not possible as the warning page does not have an option to "Report this file as safe"

Answer 1

What you are seeing is consistent with SmartScreen's design, not a broken Authenticode signature. A locally built file normally has no Mark of the Web, so Windows may not run the download-reputation check. The GitHub copy is marked as Internet-downloaded, which triggers SmartScreen.

A valid Artifact Signing signature proves publisher identity and that the bytes were not changed after signing. It does not guarantee immediate reputation. SmartScreen evaluates publisher/certificate reputation and the file hash. Each rebuilt installer has a new hash and can show the warning while reputation accumulates; EV certificates no longer bypass this process.

For the next release, sign the final installer after all packaging, include a timestamp, and do not modify or repack the file afterward. Download the release asset and compare its SHA-256 with the signed build, then confirm Get-AuthenticodeSignature reports Valid and the publisher name matches warning-free releases. Keep the same Artifact Signing account and certificate profile so the publisher signal remains consistent.

Since you already submitted the downloaded file, reply to that submission or open an Artifact Signing support case with the submission ID, SHA-256, certificate-profile ID, publisher name, and screenshots. Explain that the instructed “Report this file as safe” control is absent. There is no supported local command to reset SmartScreen reputation; it is service-side and builds from clean download history.