RustDesk says the certificate cannot be verified

• In December 2025 the code-signing certificate used for free RustDesk builds was revoked by its certificate authority. The reasons are between the authority and RustDesk; public information is limited and we will not speculate.
• Revocation is retroactive. Once a certificate is on the revocation list, installers already signed with it stop validating too — the system checks revocation status at verification time. Downloading the newest release rather than an older one changes nothing.
• The publicly stated remedy is for paid users to rebuild their own client with a new certificate. Free builds remain in the untrusted-signature state.
• On Windows you see a warning that the publisher could not be verified to a trusted root certification authority, SmartScreen reports an unknown publisher, and some antivirus products quarantine or delete the file. Driver-dependent features such as remote printing may fail to install.
• macOS is a separate matter unrelated to this revocation: RustDesk's macOS builds have long had unsigned or un-notarised releases, so Gatekeeper blocks them and you have to allow the app by hand.

These two get conflated constantly, but they answer different questions and call for different responses.

A code signature answers “who published this file, and do I trust that publisher?” When the certificate is revoked, that question loses its answer, so the system falls back to the most conservative warning it has.

A file hash answers “is the content of this file byte-for-byte identical to the official release?” That question is unaffected by the certificate and can still be answered exactly.

So the conclusion is direct: once the signature stops being trustworthy, hash verification moves from optional to mandatory. Nothing is checking on your behalf any more.

1. Download only from rustdesk.com or its official GitHub releases page. Avoid third-party download sites from search results — bundled and modified builds are common there, and you no longer have a signature to fall back on.
2. Compare the SHA-256. The official release page lists a checksum next to each installer. On Windows open PowerShell and run Get-FileHash with the path to the installer; on macOS and Linux run shasum -a 256 with the filename. Compare the output against the official page digit by digit. An exact match means the file is byte-identical to the official release.
3. Cross-check on VirusTotal. Drop the installer on www.virustotal.com/gui/home/upload and look at the spread. A handful of heuristic engines flagging it while the major vendors pass it is the classic false-positive pattern; if most major engines flag it, do not install.
4. If the hash does not match, do not install it. At that point this is not a false positive — the file really is wrong.

1. When SmartScreen blocks the file, click More info on the left, then Run anyway. If that button is absent, the machine's app-install policy is restricted to Store apps: go to Settings → Apps → Advanced app settings and set “Choose where to get apps” to Anywhere.
2. If antivirus already deleted the file, restore it first under Windows Security → Virus & threat protection → Protection history. Skipping this means the second install gets deleted too.
3. Add an exclusion for the RustDesk install folder. The full click-path, plus the equivalent settings in third-party suites, is written out step by step in our guide on antivirus false positives — the procedure is identical, so we do not repeat it here.
4. If you need remote printing or another driver-dependent feature, note that the driver may fail to install while the signature is untrusted. There is no workaround; use software with a valid signature instead.

1. When the app reports that it is damaged and cannot be opened, or that the developer cannot be verified, do not click Move to Trash — click Cancel.
2. Open System Settings → Privacy & Security and scroll to the Security section. The app you just tried to open is listed there; click Open Anyway next to it and confirm with your password.
3. Grant two permissions before the first session, or you will connect and get a black screen or an unresponsive desktop: tick RustDesk under Screen Recording and again under Accessibility on the same page. Quit the app completely and reopen it for the change to take effect.
4. If Open Anyway never appears, the machine's security policy is managed — common on company hardware — and an administrator has to handle it.

• Company-managed computers. Group policy usually blocks programs with untrusted signatures, you will not get it allowed, and trying may breach company rules.
• Any time you cannot complete the hash check. If neither the signature nor the hash gives you assurance, do not install it.
• When you need remote printing or another driver-dependent feature.
• When you are helping a relative who is not comfortable with computers and cannot be walked through the warnings over the phone. Teaching someone to click Run anyway repeatedly is training a dangerous habit.
• In those cases use TeamViewer (www.teamviewer.com) or AnyDesk (anydesk.com) instead. Both have valid code signatures, so none of the warnings in this guide appear; both are free for personal use and require a licence for commercial use.

Remote-control software is a favourite tool of phone and messaging scams: someone impersonates support, a bank, or law enforcement, asks you to install a remote tool and read out the connection code, and once they have control they can operate your online banking and read your verification codes.

So hold to one hard rule: our support staff will never contact you first asking you to install remote-control software, and will never ask you for a connection code. Verify anyone who approaches you with such a request in our official group before doing anything.

When you genuinely need remote help, you start the session and you end it, and you can see everything happening on your screen throughout. If anyone asks you to minimise the window or step away from the computer, disconnect immediately.