I have a product which I sell to customers. It includes a PC running Windows 7, something like a Kiosk-system. There are two user accounts, one Admin and one User account. The user account should have nearly no rights, while the Admin account should have all the rights. To make things more safe, I use windows software restriction policies (SRP), so that the user is only allowed to run executables signed by me with a rule. I created these certificates with OpenSSL and then sign my executables with SignTool. This works like a charm.
My question is now, how to handle these certificates? I sell these PCs all around the world and I am not able to update all these certificates if they expire. I could make them last 100 years, but I'm not reassured with this. I offer software updates every year or so. Is there a easy and secure way to update the certificates with these software updates?
I would be very pleased if someone could may help me with this question.
Thanks in Advance, Max