While for MSIs, this was an optional step, signing your MSIX package is mandatory. Microsoft’s MSIX technology requires the use of code signing certificates to deploy packages.

Many of us are aware of the importance of securing our applications and how digital signatures are a solid way to avoid security breaches. For those looking into MSIX, you must know that Microsoft enforces digital signature for all packages within this technology. There is no exception.

With the experience of unfortunate security breaches in recent years, the focus of making safe and reliable applications has increased in the software industry. This is why adding a digital signature to your application has become a must -- and for MSIX applications it is mandatory.

Digital signing is an important stage of an application packaging cycle and can be achieved by code signing your own software’s certificates. By digitally signing your software, you prove your application’s authenticity and integrity upon installation and guarantee that the software you developed hasn’t been compromised or corrupted.

You've finished building your MSIX application, and it's time to share it with the rest of the world.

Starting with January 1st, 2016 Microsoft is implementing a mandatory update of the Digital Signature system from SHA-1 to SHA-2 in order to deal with the decreasing security of the SHA-1 digital signatures. A limited dual-signing system is supported for backwards compatibility.