Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I recently stopped distributing my software, so I no longer use the digital certificate (AKA digital signature) I created for it.

A couple of days ago, a large software company offered to buy the digital certificate and use it to sign their products (I don't know what for, probably AV issues).
The thing is, my company is still officially operating (I still got some ongoing passive incomes from side projects) and I need to keep the company alive for at least a year.

I have a couple of questions regarding that:

  1. What are the legal aspects of licensing/selling the digital certificate to be used by a 3rd party company?
  2. What are the practical problems that might come up? (I can't think of anything at the moment)
  3. At what price would you sell/license a digital certificate?

Thanks

NOTE: If this is not the right place to post, please leave a comment where I should ask this question and I'll erase it from here, please don't down vote.

share|improve this question
    
Why can't the large software company go to microsoft/apple... and get there own digital certificate? There is no reason ever to sell such a certificate that is in your name/your companies name unless you are selling full control of the company and name. Even then, revoke and let them get a new one under the name is a better option. –  ewanm89 Jun 16 '13 at 9:46
    
@ewanm89 - I totally agree, that's what I told them. The thing is, they already have a digital certificate, and they want a secondary one (not sure why, probably AV issues). They are traded in the stock market, so creating a new company would involve board meetings, notifying shareholders, etc. Buying an existing one would be much easier for them. –  Bagelzone Ha'bonè Jun 16 '13 at 9:50
add comment

1 Answer

up vote 7 down vote accepted

Signing software with the cert means that you are certifying that you stand behind the software. This would no longer be true if you sold the cert to someone to use with their software. Therefore: don't do it unless they are buying your entire corporation.

Depending on your contract with the CA (Certificate Authority), there may also be contractual reasons why you shouldn't do it. But the primary reason is that selling the cert is the same as selling your reputation as a software developer. Why would you possibly want to do that?

share|improve this answer
    
+1 for confirming what I thought. Any further ideas, beyond legal issues why this is a bad idea? (just curiosity) –  Bagelzone Ha'bonè Jun 16 '13 at 11:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.