2

I'm quite new to code signing and could not find clear answers to the following general questions so far. It would be great if someone could clarify/explain the logic behind this and point me in the right direction:

  1. If a code signing certificate expires and needs to be renewed, can the subject attribute be changed for the new certificate without invalidating the previously created signatures? Is the public key dependent on this attribute?

  2. If a new certificate has to be created instead, what needs to be done in order to make sure previously signed code will still be valid (e.g. use the same private key?)

Use case:
Java code has been signed and deployed with a code signing certificate and delivered to customers. Certificate expires and needs to be renewed/re-created in order to keep the signature valid.

Improve this question
0

2 Answers 2

Reset to default
1

Alternatively you can timestamp your code so that it remains valid even after the code signing certificate expires. There are more details about this in StackOverflow here and here.

Improve this answer
0

A certificate is a signed public key with some extra metadata (such as validity period), signed by some trusted authority (Certification Authority) that is assumed to be already trusted and whose signature can thus be validated.

Your question is more a matter of policy. I don't see why a public key used to sign code and whose certificate has expired cannot be issued a new certificate by the CA, this time with a new validity period and perhaps a new subject but the same underlying public key. As the underlying public key whose matching private key was used to sign the code remains the same, the signatures on the code itself will not need to be redone. The code signing public key itself is not dependent on the metadata contained in its certificate (rather, the signature on the certificate, done by the CA, is dependent on all the metadata).

Having said that, there may be some security/IT policy in place requiring a new keypair to be generated for every certificate, in which case the code itself will need to be resigned as part of issuing a new certificate. But again, from a technical/crypto point of view this is not really mandatory.

Improve this answer

You must log in to answer this question.