I usually make free windows applications, now I want to digitally sign them. So users can be sure that its from me. But instead of buying the code signing certificate, I thought I may create my own. But then again, if I can create, then anybody can create with same info as mine. However I don't actually understand how this whole thing works at end user.
Lets say I have a string in my application, and I digitally sign it. But then some other guy changes that string and he create his own certificate with same company name as mine then signs it. How the end user will know it's from him, not from me. Or Its doesn't work this way?
As far as I understood, when creating own certificate, it needs to be added in some sort of store so Windows can recognize it ? That means, if I create my own certificate, all end users will need to add my certificate as well in their Computers? And if that's true, then how can I be sure that if I purchase the certificate, it will be available at user end. What if its not there?