diff --git a/cmake/macros/OptionalWinExecutableSigning.cmake b/cmake/macros/OptionalWinExecutableSigning.cmake
new file mode 100644
index 0000000000..61eb26b3ed
--- /dev/null
+++ b/cmake/macros/OptionalWinExecutableSigning.cmake
@@ -0,0 +1,36 @@
+#
+#  OptionalWinExecutableSigning.cmake
+#  cmake/macros
+#
+#  Copyright 2016 High Fidelity, Inc.
+#  Created by Stephen Birarda on January 12, 2016
+#
+#  Distributed under the Apache License, Version 2.0.
+#  See the accompanying file LICENSE or http://www.apache.org/licenses/LICENSE-2.0.html
+#
+
+macro(optional_win_executable_signing)
+  if (WIN32 AND (PRODUCTION_BUILD OR PR_BUILD))
+    if (DEFINED ENV{HF_PFX_FILE})
+      if (DEFINED ENV{HF_PFX_PASSPHRASE})
+        # find signtool
+        find_program(SIGNTOOL_EXEC signtool PATHS "C:/Program Files (x86)/Windows Kits/8.1" PATH_SUFFIXES "bin/x64")
+
+        if (NOT SIGNTOOL_EXEC)
+          message(FATAL_ERROR "Code signing of executables was requested but signtool.exe could not be found.")
+        endif ()
+
+        # setup the post install command to sign the executable
+        set(SIGN_COMMAND "${SIGNTOOL_EXEC} sign /f $ENV{HF_PFX_FILE} /p $ENV{HF_PFX_PASSPHRASE} /tr http://tsa.starfieldtech.com\
+          /td SHA256 \${CMAKE_INSTALL_PREFIX}/${EXECUTABLE_NAME}"
+        )
+
+        install(CODE "execute_process(COMMAND ${SIGN_COMMAND})" COMPONENT ${EXECUTABLE_COMPONENT})
+      else ()
+        message(FATAL_ERROR "HF_PFX_PASSPHRASE must be set for executables to be signed.")
+      endif ()
+    else ()
+      message(WARNING "Producing a production build or PR build but not code signing since HF_PFX_FILE is not set.")
+    endif ()
+  endif ()
+endmacro()
diff --git a/interface/CMakeLists.txt b/interface/CMakeLists.txt
index 4248aa745d..aabfc1031c 100644
--- a/interface/CMakeLists.txt
+++ b/interface/CMakeLists.txt
@@ -238,6 +238,11 @@ else (APPLE)
       DESTINATION ${INTERFACE_INSTALL_DIR}
       COMPONENT ${CLIENT_COMPONENT}
     )
+
+    set(EXECUTABLE_NAME "${INTERFACE_EXEC_PREFIX}.exe")
+    set(EXECUTABLE_COMPONENT ${CLIENT_COMPONENT})
+
+    optional_win_executable_signing()
   endif()
 endif (APPLE)