3

I usually make free windows applications, now I want to digitally sign them. So users can be sure that its from me. But instead of buying the code signing certificate, I thought I may create my own. But then again, if I can create, then anybody can create with same info as mine. However I don't actually understand how this whole thing works at end user.

Lets say I have a string in my application, and I digitally sign it. But then some other guy changes that string and he create his own certificate with same company name as mine then signs it. How the end user will know it's from him, not from me. Or Its doesn't work this way?

As far as I understood, when creating own certificate, it needs to be added in some sort of store so Windows can recognize it ? That means, if I create my own certificate, all end users will need to add my certificate as well in their Computers? And if that's true, then how can I be sure that if I purchase the certificate, it will be available at user end. What if its not there?

2
  • 1
    In short: A certificate from a thrusted party will say it's from YOU, a self-signed certificate will say it's from THAT ONE AGAIN, it the user chose to thrust the certificate once.
    – Marcel
    Oct 30 '14 at 6:13
  • 1
    Several certificate authorities provide FREE certificates for open source projects.
    – Monika
    Oct 30 '14 at 18:12
7

In order to tell the end user that the YOU are the actual owner of the app, you MUST buy a certificate from a trusted third party (a party which is also trusted by Windows). These third parties are called Certificate Authorities (CA). Here's how you can get a certificate from a CA (according to MSDN).

How the end user will know its from him, not from me. Or Its doesnt work this way ?

Now, one of the responsibilities of a CA is to verify your identification before issuing you a certificate. Therefore, no "other guy" can get a valid certificate with your identity from a CA. Your certificate is verified by the Windows through a process called Chain of Trust verification. You can find more details about the process here.

As far as I understood, when creating own certificate, it needs to be added in some sort of store so Windows can recognize it ?

I think the store you are talking about here is the Microsoft's Certificate Store Technology which is basically used to store all your certificates, so that you can choose them while signing. Also, you don't have to worry about availability of your certificate at end user. Since your certificate is signed by the CA (CA trusts you) and Microsoft trusts that Certificate Authority and End user trusts Microsoft, user will have no problem identifying that the code belongs to you.

6
  • So If I sign an app with my own made certificate, it will work on all users end ?
    – xmen
    Oct 30 '14 at 5:25
  • If your certificate is signed by a trusted certificate authority, then yes. Usually the term "buying a certificate" means getting a signed certificate from a trusted CA. Oct 30 '14 at 5:34
  • @RahilArora What means "You identity is verified by the Windows"? Do you mean a CA here, or Microsoft?
    – Marcel
    Oct 30 '14 at 6:10
  • But what will happen if I use my own certificate ?
    – xmen
    Oct 30 '14 at 6:36
  • 1
    If you use "your own" certificate a self-signed cert or one issue with your own CA) then the end user will not have it in his trust chain and therefore it will fail to validate: he will get a warning about an application not signed by a valid cert. What happen next depends on the environment, user and type of app but you can assume that having an invalid cert is worse than having no signature at all.
    – Stephane
    Oct 30 '14 at 8:37
3

The point of code signing is to prove that the program is from a particular, presumably reliable, source. Typically a CA based certificate ensures that some identity verification has been done so you have a fairly high degree of trust that the code is from the person who signed it.

You can self-sign, which will still prove that it was released by the holder of the private key that corresponds to the public key it is signed with, however, there is no independent verification of the identity, so it is only useful for verifying the same person produced two different programs.

Someone else could make a similar certificate with the same details, but they would not have your private key and the thumbprint of the certificate would not match. Your users shouldn't be trusting the identity information of a self-signed certificate anyway, they should just know that the last program they got from you matches the new program they got from you, so if the first was actually from you, then so is the second.

Without compromising your private key, which only you have, there is no way for the attacker to match the thumbprint of your signature, thus they can't truly impersonate you to an alert user.

That said, your average user may well not recognize that fact and would just trust whatever is provided by the certificate, even if it has a different thumbprint. This is why it really is worth getting a code signing cert from a CA if you want to do this kind of thing.

You can obtain one very cheaply from some of the cheaper CAs. Personally, I got mine through StartSSL. It was $60 to get my identity verified and after that I can issue as many SSL certs and S/Mime certs as I want in my name for a year, as well as being issued a code signing certificate in my name.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.