3

I have a product which I sell to customers. It includes a PC running Windows 7, something like a Kiosk-system. There are two user accounts, one Admin and one User account. The user account should have nearly no rights, while the Admin account should have all the rights. To make things more safe, I use windows software restriction policies (SRP), so that the user is only allowed to run executables signed by me with a rule. I created these certificates with OpenSSL and then sign my executables with SignTool. This works like a charm.

My question is now, how to handle these certificates? I sell these PCs all around the world and I am not able to update all these certificates if they expire. I could make them last 100 years, but I'm not reassured with this. I offer software updates every year or so. Is there a easy and secure way to update the certificates with these software updates?

I would be very pleased if someone could may help me with this question.

Thanks in Advance, Max

Improve this question
2
  • Certificate expiry is a defence against he possibility of a private key being compromised, i.e. someone else would be able to sign binaries for these machines. How do you (or would you) deal with revoking a certificate? If you have no way of revoking a compromised certificate, then the expiry date is the only safeguard. i.e. someone else would only be able to compromise machines only until a certain point in time.
    – grochmal
    Commented Sep 15, 2016 at 0:10
  • Thanks. Yes, this was exactly my thought.. I would like to update these certificates with my update system, as I offer every half a year or so a new version of my software running on the PC. I thought maybe there is an easy way to update these certificates, but I don't whats the best possibility to do that
    – Max R.
    Commented Sep 15, 2016 at 9:40

1 Answer 1

Reset to default
1

Really you should use certificates that are issued from a trusted root certificate not a self-signed one. This gives customers the knowledge that the cert in use is valid. Using self-signed certs means that someone could, theoretically replace the cert with their own - using their own private key to sign a replaced executable. So really you are not providing that much security using self-signed ones.

In addition, it isn't really just the certs you need to handle but the signed executables. I guess that it is fine for customers to retain an exe signed with an expired cert as long as the dates all match up. If this isn't acceptable, you will have to create a way to distribute updated exe's and this is a standard software distribution problem. I'm sure you will find a convenient library or tool to help depending on the toolchain you are using to create and distribute the code in the first place.

Improve this answer
4
  • Thanks you. Yes, you are right, but I don't just want my customers to be safe, I also want my system to be safe, so the customer can't install any stupid software and is angry two days later because the system does not work as it should, this is the most important thing for me.
    – Max R.
    Commented Sep 15, 2016 at 10:30
  • Well locking down a kiosk type system is perhaps a different question. But in terms of your code, having ways to be able to easily reinstall the code might be the best approach though obviously you need to take care of any local data.
    – Julian Knight
    Commented Sep 15, 2016 at 19:51
  • @MaxR. This is about trusted certificates. Trusted certificates should always be self-signed as a matter of policy and that's totally OK. It only makes sense to go to CA to sign a certificate if you are not going to trust that certificate (by definition of not trusting, you will then proceed to verify the certificate's signature).
    – kubanczyk
    Commented Nov 14, 2016 at 0:11
  • To trust a self-signed certificate, you need to create your own CA. It isn't difficult but you are taking on the secure distribution & installation of the CA cert to all clients that need to trust your certs. This can be a significant overhead. Using certs signed by an existing trusted root takes away this overhead.
    – Julian Knight
    Commented Nov 14, 2016 at 9:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .