Code Signing - Revision history

Leo at 22:08, 21 April 2019

2019-04-21T22:08:20Z

← Older revision		Revision as of 22:08, 21 April 2019
Line 36:		Line 36:
	}}		}}

	Sign the code using {{code\|signtool}}.		Sign the code using {{code\|signtool}}. You can sign and timestamp all in one step. Alternatively, you can use {{code\|signtool timestamp}} to add or update the timestamp countersignature after signing.
	{{highlight\|lang=terminal\|code=		{{highlight\|lang=terminal\|code=
			## Options
			## /f = The pfx certificate and private key file
			## /fd = The signing algorithm. If not specified, SHA1 will be used
			## /tr = Timestamping server
			## /td = Timestamping algorithm
	$ signtool sign /v /f SPC.pfx /fd sha256 /tr http://sha256timestamp.ws.symantec.com/sha256/timestamp /td sha256 putty.exe		$ signtool sign /v /f SPC.pfx /fd sha256 /tr http://sha256timestamp.ws.symantec.com/sha256/timestamp /td sha256 putty.exe
	}}		}}

	The timestamping URL should point to a timestamping service that allows for the certificate's timestamp to be authenticated. See the [[#Timestamping Services]] section for other options and information.		{{Info\|Use SHA256\|SHA-1 is deprecated and all code signing should be done with SHA256. This includes the timestamp countersignature.}}

			The timestamping URL should point to a timestamping service that allows for the certificate's timestamp to be authenticated. This is done by adding an extra timestamp countersignature to the signature. See the [[#Timestamping Services]] section for other options and information.

	== Timestamping Services ==		== Timestamping Services ==
Line 54:		Line 61:
	* http://timestamp.globalsign.com/?signature=sha2		* http://timestamp.globalsign.com/?signature=sha2

	Without timestamping, the certificate's signature is verified at the current time, which may be past the certificate's validity period, rendering the signature as invalid if the certificate has expired.		Without timestamping, the certificate's signature is verified using the current system time, which may be past the certificate's validity period, rendering the signature as invalid if the certificate has expired.

	With timestamping however, the certificate's signature will be verified at the time of signing as specified by the timestamp service. Regardless of whether the certificate has expired at the time of verification, the signature will still be valid.		With timestamping however, the certificate's signature will be verified at the time of signing as specified by the timestamp service. Regardless of whether the certificate has expired at the time of verification, the signature will still be valid.

Leo: /* Self-Signed Code Signing Certificate */

2019-04-21T21:56:16Z

Self-Signed Code Signing Certificate

← Older revision		Revision as of 21:56, 21 April 2019
Line 38:		Line 38:
	Sign the code using {{code\|signtool}}.		Sign the code using {{code\|signtool}}.
	{{highlight\|lang=terminal\|code=		{{highlight\|lang=terminal\|code=
	$ signtool sign /v /f SPC.pfx /t http://~~timestamp~~.~~verisign~~.com/~~scripts~~/~~timstamp.dll~~ putty.exe		$ signtool sign /v /f SPC.pfx /fd sha256 /tr http://sha256timestamp.ws.symantec.com/sha256/timestamp /td sha256 putty.exe
	}}		}}

Leo: /* Timestamping Services */

2019-04-21T21:53:31Z

Timestamping Services

← Older revision		Revision as of 21:53, 21 April 2019
Line 52:		Line 52:
	SHA-256, RFC 3161 timestamping URLs:		SHA-256, RFC 3161 timestamping URLs:
	* http://sha256timestamp.ws.symantec.com/sha256/timestamp		* http://sha256timestamp.ws.symantec.com/sha256/timestamp
			* http://timestamp.globalsign.com/?signature=sha2

	Without timestamping, the certificate's signature is verified at the current time, which may be past the certificate's validity period, rendering the signature as invalid if the certificate has expired.		Without timestamping, the certificate's signature is verified at the current time, which may be past the certificate's validity period, rendering the signature as invalid if the certificate has expired.

Leo at 21:11, 21 April 2019

2019-04-21T21:11:31Z

← Older revision		Revision as of 21:11, 21 April 2019
Line 1:		Line 1:
			A code signing certificate, also known as a Software Publisher Certificate (SPC), ensures that binaries that are distributed are from a known and trusted source and have not been tampered with.

	== Self-Signed Certificate ==		== Self-Signed Code Signing Certificate ==
	The following was done inside the Developer Command Prompt from Visual Studio. The utilities used in this section are {{code\|makecert}}, {{code\|signtool}}, and {{code\|pvk2pfx}}.		The following was done inside the Developer Command Prompt from Visual Studio. The utilities used in this section are {{code\|makecert}}, {{code\|signtool}}, and {{code\|pvk2pfx}}.

	Use the {{code\|makecert}} utility to generate a new certificate authority, and then a ~~certificate~~ based on this CA. In both cases, you have the option to specify a password for the private key.		Use the {{code\|makecert}} utility to generate a new certificate authority, and then a SPC based on this CA. In both cases, you have the option to specify a password for the private key.

	{{highlight\|lang=terminal\|code=		{{highlight\|lang=terminal\|code=
	<nowiki>		<nowiki>
			## Options used by makecert are:
			## -r = self signed
			## -pe = private key is exportable
			## -n = subject's certificate name
			## -a = signature algorithm
			## -cy = certificate type. authority being a CA, end being end-entity
			## -sky = subject's key type. Signature, used for digital signature.
			## -sv = Subject's pvk private key file
			## -ic = Issuer's certificate
			## -iv = Issuer's pvk private key

	## Generate a CA, issued to "Self Signed CA"		## Generate a CA, issued to "Self Signed CA"
	$ makecert -r -pe -n "CN=Self Signed CA" -ss CA -a sha256 -cy authority -sky signature -sv CA.pvk CA.cer		$ makecert -r -pe -n "CN=Self Signed CA" -ss CA -a sha256 -cy authority -sky signature -sv CA.pvk CA.cer
	Succeeded		Succeeded

	## Generate a ~~certificate~~ with this CA, issued to "Leo Leung"		## Generate a SPC with this CA, issued to "Leo Leung"
	$ makecert -pe -n "CN=Leo Leung" -a sha256 -cy end -sky signature -ic CA.cer -iv CA.pvk -sv SPC.pvk SPC.cer		$ makecert -pe -n "CN=Leo Leung" -a sha256 -cy end -sky signature -ic CA.cer -iv CA.pvk -sv SPC.pvk SPC.cer
	Succeeded		Succeeded
	</nowiki>		</nowiki>
Line 40:		Line 52:
	SHA-256, RFC 3161 timestamping URLs:		SHA-256, RFC 3161 timestamping URLs:
	* http://sha256timestamp.ws.symantec.com/sha256/timestamp		* http://sha256timestamp.ws.symantec.com/sha256/timestamp


	Without timestamping, the certificate's signature is verified at the current time, which may be past the certificate's validity period, rendering the signature as invalid if the certificate has expired.		Without timestamping, the certificate's signature is verified at the current time, which may be past the certificate's validity period, rendering the signature as invalid if the certificate has expired.

	With timestamping however, the certificate's signature will be verified at the time of signing as specified by the timestamp service. Regardless of whether the certificate has expired at the time of verification, the signature will still be valid.		With timestamping however, the certificate's signature will be verified at the time of signing as specified by the timestamp service. Regardless of whether the certificate has expired at the time of verification, the signature will still be valid.


	== See Also ==		== See Also ==
	* https://stackoverflow.com/questions/84847/how-do-i-create-a-self-signed-certificate-for-code-signing-on-windows		* https://stackoverflow.com/questions/84847/how-do-i-create-a-self-signed-certificate-for-code-signing-on-windows
			* Makecert Documentation: https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/bfsktky3(v=vs.100)

Leo: Created page with " == Self-Signed Certificate == The following was done inside the Developer Command Prompt from Visual Studio. The utilities used in this section are {{code|makecert}}, {{code|..."

2019-04-21T20:59:13Z

Created page with " == Self-Signed Certificate == The following was done inside the Developer Command Prompt from Visual Studio. The utilities used in this section are {{code|makecert}}, {{code|..."

New page

== Self-Signed Certificate ==
The following was done inside the Developer Command Prompt from Visual Studio. The utilities used in this section are {{code|makecert}}, {{code|signtool}}, and {{code|pvk2pfx}}.

Use the {{code|makecert}} utility to generate a new certificate authority, and then a certificate based on this CA. In both cases, you have the option to specify a password for the private key.

{{highlight|lang=terminal|code=
<nowiki>
## Generate a CA, issued to "Self Signed CA"
$ makecert -r -pe -n "CN=Self Signed CA" -ss CA -a sha256 -cy authority -sky signature -sv CA.pvk CA.cer
Succeeded

## Generate a certificate with this CA, issued to "Leo Leung"
$ makecert -pe -n "CN=Leo Leung" -a sha256 -cy end -sky signature -ic CA.cer -iv CA.pvk -sv SPC.pvk SPC.cer
Succeeded
</nowiki>
}}

You should have a private key and a certificate file for both the CA and code signing certificate.

To sign your code, convert the PVK private key file into a PFX file.
{{highlight|lang=terminal|code=
$ pvk2pfx -pvk SPC.pvk -spc SPC.cer -pfx SPC.pfx
}}

Sign the code using {{code|signtool}}.
{{highlight|lang=terminal|code=
$ signtool sign /v /f SPC.pfx /t http://timestamp.verisign.com/scripts/timstamp.dll putty.exe
}}

The timestamping URL should point to a timestamping service that allows for the certificate's timestamp to be authenticated. See the [[#Timestamping Services]] section for other options and information.

== Timestamping Services ==
SHA-1, RFC 3161 timestamping URLs:
* http://timestamp.verisign.com/scripts/timstamp.dll
* http://timestamp.globalsign.com/scripts/timstamp.dll
* http://timestamp.comodoca.com/authenticode
* http://sha1timestamp.ws.symantec.com/sha1/timestamp

SHA-256, RFC 3161 timestamping URLs:
* http://sha256timestamp.ws.symantec.com/sha256/timestamp

Without timestamping, the certificate's signature is verified at the current time, which may be past the certificate's validity period, rendering the signature as invalid if the certificate has expired.

With timestamping however, the certificate's signature will be verified at the time of signing as specified by the timestamp service. Regardless of whether the certificate has expired at the time of verification, the signature will still be valid.

== See Also ==
* https://stackoverflow.com/questions/84847/how-do-i-create-a-self-signed-certificate-for-code-signing-on-windows