diff --git a/.gitignore b/.gitignore
index 0cab451c..016c7fb4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,3 +30,11 @@ bower_components
 
 # Compiled Electron releases
 etcher-release/
+
+# Certificates
+*.spc
+*.pvk
+*.p12
+*.cer
+*.crt
+*.pem
diff --git a/Makefile b/Makefile
index 9b7bc9b5..7b289cbf 100644
--- a/Makefile
+++ b/Makefile
@@ -10,6 +10,16 @@ COMPANY_NAME="Resinio Ltd"
 SIGN_IDENTITY_OSX="Rulemotion Ltd (66H43P8FRG)"
 S3_BUCKET="resin-production-downloads"
 
+sign-win32 = osslsigncode sign \
+	-certs certificate.crt.pem \
+	-key certificate.key.pem \
+	-h sha1 \
+	-t http://timestamp.comodoca.com \
+	-n "$(APPLICATION_NAME) - $(ETCHER_VERSION)"\
+	-in $(1) \
+	-out $(dir $(1))Signed.exe \
+	&& mv $(dir $(1))Signed.exe $(1)
+
 etcher-release/Etcher-darwin-x64: .
 	$(ELECTRON_PACKAGER) . $(APPLICATION_NAME) \
 		--platform=darwin \
@@ -72,6 +82,7 @@ etcher-release/Etcher-win32-x86: .
 		--overwrite \
 		--out=$(dir $@)
 	mv $(dir $@)Etcher-win32-ia32 $@
+	$(call sign-win32,$@/Etcher.exe)
 
 etcher-release/Etcher-win32-x64: .
 	$(ELECTRON_PACKAGER) . $(APPLICATION_NAME) \
@@ -91,6 +102,7 @@ etcher-release/Etcher-win32-x64: .
 		--version-string.InternalName="$(APPLICATION_NAME)" \
 		--overwrite \
 		--out=$(dir $@)
+	$(call sign-win32,$@/Etcher.exe)
 
 etcher-release/installers/Etcher-darwin-x64.dmg: etcher-release/Etcher-darwin-x64 package.json
 	$(ELECTRON_BUILDER) "$</$(APPLICATION_NAME).app" \
@@ -113,6 +125,7 @@ etcher-release/installers/Etcher-win32-x64.exe: etcher-release/Etcher-win32-x64
 		--out=$(dir $@)win32-x64
 	mv $(dir $@)win32-x64/Etcher\ Setup.exe $@
 	rmdir $(dir $@)win32-x64
+	$(call sign-win32,$@)
 
 etcher-release/installers/Etcher-win32-x86.exe: etcher-release/Etcher-win32-x86 package.json
 	$(ELECTRON_BUILDER) $< \
@@ -120,6 +133,7 @@ etcher-release/installers/Etcher-win32-x86.exe: etcher-release/Etcher-win32-x86
 		--out=$(dir $@)win32-x86
 	mv $(dir $@)win32-x86/Etcher\ Setup.exe $@
 	rmdir $(dir $@)win32-x86
+	$(call sign-win32,$@)
 
 package-osx: etcher-release/Etcher-darwin-x64
 package-linux: etcher-release/Etcher-linux-x86 etcher-release/Etcher-linux-x64
diff --git a/PUBLISHING.md b/PUBLISHING.md
index b1490729..51c1bf4f 100644
--- a/PUBLISHING.md
+++ b/PUBLISHING.md
@@ -12,6 +12,7 @@ Prequisites
 - [nsis (for Windows)](http://nsis.sourceforge.net/Main_Page)
 - [XCode (for OS X)](https://developer.apple.com/xcode://developer.apple.com/xcode/)
 - [AWS CLI (for uploading packages)](https://aws.amazon.com/cli://aws.amazon.com/cli/)
+- [osslsigncode (for signing the Windows installers)](https://sourceforge.net/projects/osslsigncode/)
 
 If you're going to generate installers for another platform than the one you're currently running, make sure you force-install all NPM dependencies, so optional dependencies marked for a certain operating system get installed regardless of the host operating system
 
@@ -36,6 +37,14 @@ Signing
 
 The application will be signed automatically using this certificate when packaging for OS X.
 
+### Windows
+
+1. Get access to our code signing certificate and decryption key as a Resin.io employee by asking for it to the relevant people.
+
+2. Place the cert and key in the root of the Etcher repository naming them `certificate.crt.pem` and `certificate.key.pem`, respectively.
+
+The application and installer will be signed automatically using these certificates when packaging for Windows.
+
 Packaging
 ---------