Code Signing: Difference between revisions
Created page with " == Self-Signed Certificate == The following was done inside the Developer Command Prompt from Visual Studio. The utilities used in this section are {{code|makecert}}, {{code|..." |
No edit summary |
||
| Line 1: | Line 1: | ||
A code signing certificate, also known as a Software Publisher Certificate (SPC), ensures that binaries that are distributed are from a known and trusted source and have not been tampered with. | |||
== Self-Signed Certificate == | == Self-Signed Code Signing Certificate == | ||
The following was done inside the Developer Command Prompt from Visual Studio. The utilities used in this section are {{code|makecert}}, {{code|signtool}}, and {{code|pvk2pfx}}. | The following was done inside the Developer Command Prompt from Visual Studio. The utilities used in this section are {{code|makecert}}, {{code|signtool}}, and {{code|pvk2pfx}}. | ||
Use the {{code|makecert}} utility to generate a new certificate authority, and then a | Use the {{code|makecert}} utility to generate a new certificate authority, and then a SPC based on this CA. In both cases, you have the option to specify a password for the private key. | ||
{{highlight|lang=terminal|code= | {{highlight|lang=terminal|code= | ||
<nowiki> | <nowiki> | ||
## Options used by makecert are: | |||
## -r = self signed | |||
## -pe = private key is exportable | |||
## -n = subject's certificate name | |||
## -a = signature algorithm | |||
## -cy = certificate type. authority being a CA, end being end-entity | |||
## -sky = subject's key type. Signature, used for digital signature. | |||
## -sv = Subject's pvk private key file | |||
## -ic = Issuer's certificate | |||
## -iv = Issuer's pvk private key | |||
## Generate a CA, issued to "Self Signed CA" | ## Generate a CA, issued to "Self Signed CA" | ||
$ makecert -r -pe -n "CN=Self Signed CA" -ss CA -a sha256 -cy authority -sky signature -sv CA.pvk CA.cer | $ makecert -r -pe -n "CN=Self Signed CA" -ss CA -a sha256 -cy authority -sky signature -sv CA.pvk CA.cer | ||
Succeeded | Succeeded | ||
## Generate a | ## Generate a SPC with this CA, issued to "Leo Leung" | ||
$ makecert -pe -n "CN=Leo Leung" | $ makecert -pe -n "CN=Leo Leung" -a sha256 -cy end -sky signature -ic CA.cer -iv CA.pvk -sv SPC.pvk SPC.cer | ||
Succeeded | Succeeded | ||
</nowiki> | </nowiki> | ||
| Line 40: | Line 52: | ||
SHA-256, RFC 3161 timestamping URLs: | SHA-256, RFC 3161 timestamping URLs: | ||
* http://sha256timestamp.ws.symantec.com/sha256/timestamp | * http://sha256timestamp.ws.symantec.com/sha256/timestamp | ||
Without timestamping, the certificate's signature is verified at the current time, which may be past the certificate's validity period, rendering the signature as invalid if the certificate has expired. | Without timestamping, the certificate's signature is verified at the current time, which may be past the certificate's validity period, rendering the signature as invalid if the certificate has expired. | ||
With timestamping however, the certificate's signature will be verified at the time of signing as specified by the timestamp service. Regardless of whether the certificate has expired at the time of verification, the signature will still be valid. | With timestamping however, the certificate's signature will be verified at the time of signing as specified by the timestamp service. Regardless of whether the certificate has expired at the time of verification, the signature will still be valid. | ||
== See Also == | == See Also == | ||
* https://stackoverflow.com/questions/84847/how-do-i-create-a-self-signed-certificate-for-code-signing-on-windows | * https://stackoverflow.com/questions/84847/how-do-i-create-a-self-signed-certificate-for-code-signing-on-windows | ||
* Makecert Documentation: https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/bfsktky3(v=vs.100) | |||
Revision as of 21:11, 21 April 2019
A code signing certificate, also known as a Software Publisher Certificate (SPC), ensures that binaries that are distributed are from a known and trusted source and have not been tampered with.
Self-Signed Code Signing Certificate
The following was done inside the Developer Command Prompt from Visual Studio. The utilities used in this section are makecert, signtool, and pvk2pfx.
Use the makecert utility to generate a new certificate authority, and then a SPC based on this CA. In both cases, you have the option to specify a password for the private key.
## Options used by makecert are:
## -r = self signed
## -pe = private key is exportable
## -n = subject's certificate name
## -a = signature algorithm
## -cy = certificate type. authority being a CA, end being end-entity
## -sky = subject's key type. Signature, used for digital signature.
## -sv = Subject's pvk private key file
## -ic = Issuer's certificate
## -iv = Issuer's pvk private key
## Generate a CA, issued to "Self Signed CA"
$ makecert -r -pe -n "CN=Self Signed CA" -ss CA -a sha256 -cy authority -sky signature -sv CA.pvk CA.cer
Succeeded
## Generate a SPC with this CA, issued to "Leo Leung"
$ makecert -pe -n "CN=Leo Leung" -a sha256 -cy end -sky signature -ic CA.cer -iv CA.pvk -sv SPC.pvk SPC.cer
Succeeded
You should have a private key and a certificate file for both the CA and code signing certificate.
To sign your code, convert the PVK private key file into a PFX file.
$ pvk2pfx -pvk SPC.pvk -spc SPC.cer -pfx SPC.pfx
Sign the code using signtool.
$ signtool sign /v /f SPC.pfx /t http://timestamp.verisign.com/scripts/timstamp.dll putty.exe
The timestamping URL should point to a timestamping service that allows for the certificate's timestamp to be authenticated. See the #Timestamping Services section for other options and information.
Timestamping Services
SHA-1, RFC 3161 timestamping URLs:
- http://timestamp.verisign.com/scripts/timstamp.dll
- http://timestamp.globalsign.com/scripts/timstamp.dll
- http://timestamp.comodoca.com/authenticode
- http://sha1timestamp.ws.symantec.com/sha1/timestamp
SHA-256, RFC 3161 timestamping URLs:
Without timestamping, the certificate's signature is verified at the current time, which may be past the certificate's validity period, rendering the signature as invalid if the certificate has expired.
With timestamping however, the certificate's signature will be verified at the time of signing as specified by the timestamp service. Regardless of whether the certificate has expired at the time of verification, the signature will still be valid.