I want to make a browser extension available to users. Can I sign my extension so that users can verify it is authentic, without needing to trust the web site where they got the extension from nor the security of their network connection? Which browsers support signed extensions that are easy for users to verify?

  • Firefox: Yes. Sign your .xpi file using xpisign.py (with a certificate from a trusted issuer, such as Verisign).
    Integrity: Firefox will report a corrupt add-on if the hashes do not match.
    Verification: The user just needs to see if the add-on installation prompt says "Name of extension (developer name)" instead of "Name of extension (author not verified)"
  • Chrome: Yes. The .crx file is a zip file preceded by a public key and zip content's signature.
    Integrity: Chrome will abort the installation and show CRX_SIGNATURE_VERIFICATION_FAILED if the extension's signature is invalid.
    Integrity: (alternative method) Cut the headers from the crx file, and extract the public key and signature. Check if the signature is correct.
    Verification: Check if the public key matches with your key.
  • Opera: The .oex file (=a plain zip file) cannot be signed.
    Opera 15+: The .nex or .crx file has the same format as Chromium's .crx file.
  • Safari: You can only install a Safari extension if it's signed with a key which matches a certificate which is signed by Apple. More info on signing .safariextz files.
    Integrity: Safari refuses to install invalid extensions.
    Verification: Extract the certificates from the extension using xar -f path/to/name.safariextz --extract-certs output_dir. Then check if the first certificate (output_dir/cert00) is identical to the developer's certificate (or at least check if the properties (such as the Developer's ID and name) are plausible).

  • Internet Explorer: The "extensions" are .dll files (BHO, accelerators, ...) which can be signed, using Microsoft's signtool for example.
    Verification: Look at the properties of the file, and check if the signature is deemed valid by Windows.

  • (NPAPI) plug-ins: The plug-in's binaries can be signed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.