11

What is the best way for an enterprise to manage code signing certificates? The default seems to be that Apple and Android keys get stored by each developer on their machines.

I see systems like Amazon Key Management Service and Microsoft Key Vault that seem to be ideal for this, but I don't think that it is actually possible to use them for iOS and Android apps. To me, it looks like the ideal way to handle this, would be that the code is submitted to a centralized key server, which signs the code for the developer, without ever revealing the private key to the developer. Change developers, and you simply revoke their access to the key management server. Then you also have one strategy to handle all of your various keys. It also seems easier to integrate with continuous delivery.

Is there any strategy that organizations use to manage their private keys for code signing both ios and android apps?

Improve this question
9
  • 1
    Why not just create a build server like Jenkins. Install the certs on that machine as a part of the build script, and only give the developer access to the input/output.
    – Aron
    Dec 1, 2015 at 6:08
  • 2
    @Aron -- that helps. I just thought that many enterprises would be using some more secure Keyvault/KSM/HSM style code signing process, and I'm surprised I've never heard of such a thing and can't find any details indicating that such a thing exists.
    – user1724280
    Dec 1, 2015 at 15:16
  • The reason you can't find it is because it doesn't exist as it would defeat the purpose of having a private key. Consider what signing actually means. It is proof that the code originated from you...
    – Aron
    Dec 1, 2015 at 17:26
  • 1
    @Aron, of course signing is proof that it comes from your organization. Which is why typically, for every single other cryptographic signing purpose except for some reason code signing, an organization will want to control access to the signing certificate through a keyvault........
    – user1724280
    Dec 1, 2015 at 19:23
  • 2
    @Aron, I'm honestly not sure if I don't understand what you are saying, or if you don't understand what a key vault does. With a key management server, nobody has access to the private key. It is never transferred anywhere but resides only within the vault. Your employees have access to instruct the machine to sign specific things, for a specific time period. If the employee moves to a new team with different rights, they are no longer able to sign things. An organization should always assume they may need to revoke an employees rights to sign things on their behalf...
    – user1724280
    Dec 2, 2015 at 2:07

2 Answers 2

Reset to default
1

For iOS and OSX there are 'developer' certificates, needed to provision on up to 100 devices; and 'distribution' certificates, needed to upload to the appstores. The first is personal and is bound by a developer license. The latter could be reserved for your corporate build Mac. The 'team agent' can use it and upload, and delegate rights. The distribution is the one to watch.

Improve this answer
1

You could use an application signing tool which is stored securely which takes smart cards which contain the signing keys. The application signing tool (USB connected hardware which takes the smart card) can be stored separate to the smartcard. Developers and testers can test the application using dev/test keys but, once the application is ready for release, someone can perform the final signing under dual control, due to separate access to the above tools, and this can be released to Operations for deployment to production.

Improve this answer
1
  • This might work perfectly for a small scale but @user1724280 has already mentioned he's looking for a more adopted , safe and secure solution.
    – Adib N
    May 26, 2017 at 16:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .