diff --git a/.gitignore b/.gitignore
index cfcd6c34e69..9cf0806e4b2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -52,3 +52,6 @@ install4j6/
 
 # ignore the generated markdown file if the user forgets to delete it
 status.md
+
+# private data
+/buildres/jabref-cert-2016.p12
diff --git a/.travis.yml b/.travis.yml
index 692661c6bd1..2f7ee0338c6 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -11,7 +11,7 @@ addons:
     packages:
       # most recent Java8 - this makes the JDK switcher obsolete - see https://github.com/travis-ci/travis-ci/issues/5897#issuecomment-218354129
       - oracle-java8-installer
-      # MySQL 5.6 as desccribed at https://docs.travis-ci.com/user/database-setup/#MySQL-5.6
+      # MySQL 5.6 as described at https://docs.travis-ci.com/user/database-setup/#MySQL-5.6
       - mysql-server-5.6
       - mysql-client-core-5.6
       - mysql-client-5.6
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ce3a60555d8..3d47c7c2c7b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ We refer to [GitHub issues](https://github.com/JabRef/jabref/issues) by using `#
 
 ### Changed
 - URLs can now be passed as arguments to the `-import` and `-importToOpen` command line options. The referenced file is downloaded and then imported as usual.
+- Windows and OSX binaries are now signed with a certificate.
 - The default emacs executable name on linux changed from `gnuclient` to `emacsclient`. [feature-request 433](https://sourceforge.net/p/jabref/feature-requests/433/)
 - Adds integrity check to detect all bibtex keys which deviate from their generation pattern [#2206](https://github.com/JabRef/jabref/issues/2206)
 - Adds an integrity check that detects invalid DOIs [#1445](https://github.com/JabRef/jabref/issues/1445)
diff --git a/build.gradle b/build.gradle
index 401868168ee..cc3c81f6eb0 100644
--- a/build.gradle
+++ b/build.gradle
@@ -342,6 +342,8 @@ if (hasProperty('dev')) {
 task media(type: com.install4j.gradle.Install4jTask, dependsOn: "releaseJar") {
     projectFile = file('jabref.install4j')
     release = project.version
+    winKeystorePassword = System.getenv('CERTIFICATE_PW')
+    macKeystorePassword = System.getenv('CERTIFICATE_PW')
     variables = [
             versionFourDots: project.ext.threeDotVersion,
             buildFileName  : jar.archiveName,
diff --git a/buildres/jabref-cert-2016.p12.enc b/buildres/jabref-cert-2016.p12.enc
new file mode 100644
index 00000000000..6277bb8abdd
Binary files /dev/null and b/buildres/jabref-cert-2016.p12.enc differ
diff --git a/circle.yml b/circle.yml
index 5043ee6f2d5..148d880cfde 100644
--- a/circle.yml
+++ b/circle.yml
@@ -6,8 +6,11 @@ machine:
 
 dependencies:
   pre:
+    # update locally with:
+    # openssl aes-256-cbc -e -in ./buildres/jabref-cert-2016.p12 -out jabref-cert-2016.p12.enc -k {PASSWORD}
+    - openssl aes-256-cbc -d -in ./buildres/jabref-cert-2016.p12.enc -out ./buildres/jabref-cert-2016.p12 -k $CERTIFICATE
     - scripts/prepare-install4j.sh
-    - install4j6/bin/install4jc --verbose --license=$INSTALL4J_KEY
+    - install4j6/bin/install4jc --verbose --license=$INSTALL4J_KEY --win-keystore-password $CERTIFICATE_PW --mac-keystore-password $CERTIFICATE_PW
   override:
     # We do this to decrease build time by using CircleCI's cache. See https://discuss.circleci.com/t/effective-caching-for-gradle/540 for a longer motivation.
     - ./gradlew compileJava
diff --git a/jabref.install4j b/jabref.install4j
index 0d5c17660ae..210e8554a8d 100644
--- a/jabref.install4j
+++ b/jabref.install4j
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <install4j version="6.1.3" transformSequenceNumber="5">
-  <directoryPresets config="./LICENSE" />
+  <directoryPresets config="build/releases/${compiler:buildFileName}" />
   <application name="JabRef" distributionSourceDir="" applicationId="0034-7691-1464-4754" mediaDir="build/install4j" mediaFilePattern="${compiler:sys.shortName}_${compiler:sys.platform}_${compiler:sys.version}" compression="6" lzmaCompression="false" pack200Compression="false" excludeSignedFromPacking="true" commonExternalFiles="false" createMd5Sums="true" shrinkRuntime="true" shortName="JabRef" publisher="JabRef Community" publisherWeb="http://www.jabref.org/" version="DEV" allPathsRelative="true" backupOnSave="false" autoSave="true" convertDotsToUnderscores="true" macSignature="????" macVolumeId="780dfea2d33a0244" javaMinVersion="1.8" javaMaxVersion="" allowBetaVM="false" jdkMode="runtimeJre" jdkName="">
     <languages skipLanguageSelection="true" languageSelectionInPrincipalLanguage="false">
       <principalLanguage id="en" customLocalizationFile="" />
@@ -41,7 +41,7 @@
       <variable name="version" value="3.1dev" description="" category="" />
     </variables>
     <mergedProjects />
-    <codeSigning macEnabled="false" macPkcs12File="" windowsEnabled="false" windowsKeySource="pkcs12" windowsPvkFile="" windowsSpcFile="" windowsPkcs12File="" />
+    <codeSigning macEnabled="true" macPkcs12File="./buildres/jabref-cert-2016.p12" windowsEnabled="true" windowsKeySource="pkcs12" windowsPvkFile="" windowsSpcFile="" windowsPkcs12File="./buildres/jabref-cert-2016.p12" />
   </application>
   <files keepModificationTimes="false" missingFilesStrategy="warn" globalExcludeSuffixes="" defaultOverwriteMode="4" defaultUninstallMode="0" launcherOverwriteMode="3" defaultFileMode="644" defaultDirMode="755">
     <filesets />