Code signing certificate for embedded application

Question

Preview:

I am developing a secured embedded application which receives a code , signed using RSA-2048 and verifies its signature before activating it using a pre-programmed public key. I want to use code-signing certification in order to verify the entity which created and signed this code. I did a research online and I didn't found any clear flow on the usage of such certificates , I have the following questions remained without a clear answer.

Questions:

1.Suppose a CA will issue such a certificate for the code , does the public key which is signing the certificate will be attached to it ? if so , what will prevent an attacker from altering this certificate and signing it with his own pair of keys ? and if not , where the public key to authenticate the certificate will come from ?

2.Do I have to parse the certificate inside the embedded application ?

3.Where can I get an example of such a certificate ?

Answer 1

Suppose a CA will issue such a certificate for the code , does the public key which is signing the certificate will be attached to it ?

Not directly. However, it is easily to obtain the issuer's public key by building the certificate chain, which will include all certificates in the certification path and their public keys. Normally, you don't have to write your own code for that, just use any suitable crypto framework to retrieve issuer certificate and validate the code signing certificate.

For Windows platform you should use Windows CryptoAPI, for *nix you may use OpenSSL.

Do I have to parse the certificate inside the embedded application ?

again, not directly. Use suitable crypto frameworks and delegate them all certificate validation tasks. They will ensure if presented certificate and its chain is valid and not tampered.

Where can I get an example of such a certificate ?

for productional environments it is preferred to purchase code signing cert from a globally trusted commercial CA.

For private scenarios you can use enterprise private PKI to obtain such certificate. Contact your systems administrator for more details.