Quote:
> Folks
> So I purchased a digital code signing certificate. $99 USD per year
> at https://secure.ksoftware.net/code_signing.html
This one offers 3 years for $225, which includes a Community Membership to
get the low price:
http://www.lindersoft.com/order_codesigning.htm
When you shop around, make sure that you look for a code signing
certificate, not SSL certificate.
There are basically two ways to get files signed:
1 - By buying certificates from Certificate Authority(CA), like VeriSign,
Comodo, etc. These verify the identity of the purchaser. However, open
source software authors could obtain free ones. These are a must if your
software is generally downloadable by anyone and you want to get rid of
"Unknown Publisher" warning. Some companies use software that restrict what
can be run to signed files. This basically reduces the chances of viruses
running, because a virus writer cannot sign his files, otherwise he would
reveal his identity. He can use a stolen certificate, but this would be
revoked by the Certificate Authority once it was found out. When a user
downloads something and tries to install it, his computer would contact one
of the known Certificate Authorities via the Internet, and verify the
signature before showing a warning to the user and before running the
installer.
2 - For in-house use only, you could use what's called a self-signed
certificate, or test certificate. You can generate that using free tools,
such as the one below, or even via VB(by using CAPICOM, which came with
Windows ME+, or IE5+ for Windows 95/98+). These can have key lengths as much
as from Certificate Authorities, but not trusted unless you perform an
additional configuration step: After creating the test certificate, go to
each computer and go to IE-->Tools-->Internet
Options-->Content-->Certificates, then import it. Now, Windows would trust
files that are signed by this certificate. There is probably a way to do
this in one step in all computers in a domain or workgroup. Note that a
rouge installer cannot perform this configuration step because Windows would
check the signature of the installer first before allowing it to run. When
using this method, no Internet access is required.
Some links:
Certificate Creation Tool (Makecert.exe)
http://msdn.microsoft.com/en-us/library/bfsktky3(VS.71).aspx
Automating Code Signing of Windows Executables
http://www.kinook.com/blog/?p=10
Comments on code signing