Hi Daniel.

>I expect we have to move to the next step. Which is "code signing". Since I have zero experience with this. Not even a copy "SignTool.exe" on my workstations - I expect it has to be downloaded from an MS-site ? -, may I ask a few questions to those who have it through it all :

You might want to some of my blog entries:

http://doughennig.blogspot.com/2007/12/code-signing-your-vfp-exes.html
http://doughennig.blogspot.com/2009/11/executable-signing-with-inno-setup.html
http://doughennig.blogspot.com/2016/02/executable-signing-using-sha-256.html

Also, see my white paper "The Latest Techniques in Deploying VFP Applications" at http://doughennig.com/papers/default.html; it has a section on digitally signing EXEs.

>1) I understand you can purchase "Extended Validation" EV or basic ones: would EV make a real difference in terms of customer acceptance, anti-virus screening and/or firewall behavior

I'm not an expert, but from what I understand, EV certificates aren't necessary.

>2) looks like Comodo is a major source for certificates: would you recommed it? Or would you suggest alternative providers. Pricing is not the most serious concern here. We are a small and new shop (but a shop!) with very limited public exposure and, among others, I wonder if the EV "Extended Validation" process can be run smoothly by, say a US provider, for a French shop?

I haven't use Comodo but have heard good things.

>3) I'm absolutely no techie on the subject. Building an "executable" from a VFP exe via defox + molebox was really an achievement here. Can I expect to run this authentication process within a reasonable timeframe ?

The most time-consuming part is getting authorized by the certificate provider. Once you've done that, it's pretty easy to adding signing your EXEs into your build process.

Doug