I am looking for a supported signing configuration for generated workflow DLLs, not only for NuGet packages.
Test environment on 14 September 2026:
Windows 11 with Smart App Control enabled.
UiPath Studio Community 2026.0.201 STS, installed under Program Files; the Studio executable has a valid UiPath signature.
A new Windows / VB project using UiPath.System.Activities 26.8.0.
Main.xaml contains only one Write Line with a fixed, non-sensitive message. No application UI interaction, credentials, or external API calls are involved.
One Run File attempt failed before the message was printed: FileLoadException, 0x800711C7. CodeIntegrity events 3077 and 3033 identify the project’s .local\install\<project-name>.dll loaded by UiPath.Executor.exe. The policy is VerifiedAndReputableDesktop, with status 0xc0e90002. The generated DLL was NotSigned.
Default Publish Certificate, Dynamic DLLs Certificate, and Sign Tool Path were blank. No external signing configuration has been tested.
The Studio settings documentation specifies .pfx/.p12 for Dynamic DLLs Certificate. The April 2026 release notes describe design-time and publish-time DLL signing. I understand that signing a .nupkg alone is different from Authenticode-signing the DLLs loaded by Windows.
Could you clarify:
Does this Studio version support signing dynamic DLLs with a publicly trusted RSA certificate whose private key is non-exportable and accessed through a Windows certificate store/CSP/KSP, a USB token, or a cloud signing provider? If so, what exact settings and supported provider integration should be used?
If Dynamic DLLs Certificate is file-based only, is there a supported external signing integration or build/deployment stage that signs every required generated DLL before it is loaded? Please distinguish local Run/Debug from running a published process, and note whether runtime or isolated-workflow invocation regenerates DLLs that require signing again.
Is there a documented, tested configuration for this workflow with Smart App Control enabled? I want to preserve hardware/cloud key protection and avoid exporting private keys, changing SAC trust/policy, or repacking published packages through an unsupported procedure.
A link to the applicable documentation and supported versions would be very helpful. Thank you.
I’ll be watching this thread as I recently had similar issue on Windows 11. I do not remember how I solved, but I probably used some kind of workaround. Here it looks like @death.and.dream.2568 asks for a proper solution.
Configure Dynamic DLLs Certificate in UiPath Studio and sign workflow DLLs using a supported .pfx/.p12 certificate.
As of current Studio versions, the built-in setting is primarily file-based certificate signing. If you use a hardware token, certificate store, or cloud-signing service, verify that the provider exposes a compatible signing workflow supported by UiPath.
For local Run/Debug, the dynamically generated DLL must be signed before Windows loads it.
For published processes, signing the NuGet package alone is not sufficient. The workflow DLLs themselves need Authenticode signing.
If workflows are recompiled (for example, during runtime generation or isolated workflow execution), newly generated DLLs may require signing again.
The safest supported path is to use UiPath’s DLL-signing capabilities with a trusted code-signing certificate and avoid modifying Smart App Control policies or repackaging published packages manually.
The remaining blocker is the connection between Studio’s signing settings and a non-exportable private key, rather than whether the DLL needs signing.
The Studio settings documentation lists a .pfx/.p12 path for Dynamic DLLs Certificate and an executable path for Sign Tool Path. I have not found a documented certificate-store selector or provider-specific signing parameters. Microsoft’s SAC guidance also requires a trusted-provider RSA signing certificate.
Could you, or a member of the UiPath Studio team, clarify the following for 2026.0.201?
Is there a supported integration that signs the generated DLL before Windows loads it while the private key remains in a hardware token/KSP or cloud service? One concrete provider/configuration example, with a documentation link and supported version, would be enough. Please indicate whether it works for local Run/Debug, published execution, or both, and how any newly generated runtime DLLs are handled.
If no such integration is currently supported, could this be confirmed as a product limitation, with the appropriate issue/feature-request reference or support channel? That would help me avoid purchasing an unusable certificate or repeating the same test.
My immediate acceptance test remains only the fixed Write Line workflow described above, with SAC enabled. I have not tested an external signer. I am not proposing private-key export, trust-policy changes, or manual package modification.
Does UiPath 2026.0.201 support signing generated workflow DLLs using a non-exportable certificate stored in a Windows certificate store, USB token/KSP, or cloud signing provider?
If yes, could you please share the supported configuration and documentation?
If not, is this currently a product limitation or is there a supported external signing method?