Question: What is a code signing certificate?
Answer: A code signing cert is an X509 certificate specifically used to sign code or software. Unlike an SSL Certificate used to protect data transmitted to and from a server which also identifies a server, and also unlike a user certificate that may be used to sign and encrypt email and files, certificates for code signing are used to sign code to ensure that code is secure and delivered untouched by its original author. The signature provided by the code signing cert ensures the code or software is legitimate and safe to use. For example, your organization may sign and deliver a software package for usage that they may sign to make sure you know it was delivered by them.
To sum up the definition, code signing simply increases confidence and trust in software.
If you already have a code signing cert and need to view the certificate details, use our Certificate Decoder.
Code Signing Certificate EV (Extended Validation)
EV, or Extended Validation, offers the same benefits as a standard certificate but with additional assurance. With EV a tougher vetting process is involved in addition to stricter requirements for hardware. The certificate and corresponding private key may live on a USB device or even a hardware security module. In addition, an EV code signing cert is trusted by the Microsoft Defender SmartScreen. Take note that a standard OV (Organization Validated) or IV (Individual Validated) code signing cert is not enough to be trusted by Microsoft SmartScreen, it must be EV.
Code Signing Certificate Free
Unfortunately, certificates for code signing are not offered for free by any publicly trusted Certificate Authorities (CAs). Compliance is expensive so it is currently not feasible to issue X509 certificates for code signing for free.
Code Signing Certificate Cheap
Cheap code signing certs are offered by several CAs, reviewed below.
Code Signing Certificate Buy
Certificates for Code Signing can be bought here. To get a certificate for code signing just follow the request process for each CA. If you need help generating a CSR, read our instructions here.
Code Signing Certificate Comodo
Thawte
Thawte Code Signing Certificate for Java and other languages.
The best code signing certificate is at your own personal discretion. Security is many times the same, especially from a reputable company. The warranty and guarantees are many times the discriminator.
Code Signing on different Operating Systems (OS)
The installation and purposes for code signing differs depending on your operating system and platform.
Code Signing Certificate Windows
Windows allows you to sign your code with any certificate by a publicly trusted CA to be used in your partner account.
Code Signing Certificate Apple
Before deploying an app to the Apple App Store, the app must be digitally signed. As with Android, this is done not with a publicly trusted code signing cert but with a key pair managed specifically for Apple.
Code Signing Android
Before deploying an app to the Google Play Store, the app must be digitally signed. As with Apple, this is done not with a publicly trusted code signing cert but with a key pair managed specifically for Google.
Code Signing Certificate Java
Java software can be signed with a code signing cert. This certificate may be any code signing cert obtained from a publicly trusted CA.
Code Signing Examples
How to sign a java jar with jarsigner:
A jar file can be signed with the jarsigner utility, included in your java installation. The private key and corresponding certificate should be in a java keystore. In this example we will be using a PKCS12 keystore. To sign a java jar file with jarsigner, run the following command:
jarsigner <to-be-signed.jar> -keystore <codesign.p12> -sigfile <signed> -signedjar <signed.jar> -tsa <http://timestamp.sectigo.com> <your_private_key_alias>
Where jarsigner <to-be-signed.jar> is the leading command and filename of the unsigned jar, -keystore <codesign.p12> is the keystore containing the private key and certificate used to sign the jar file, -sigfile <signed> is the base name for the .SF and .DSA files that will be included in your manifest in the signed jar file, -signedjar <signed.jar> is the name of the signed jar file, -tsa <http://timestamp.sectigo.com> is the url of the Time Stamping Authority (TSA) in this case Sectigo but will be from the issuer of the certificate you are using, and <your_private_key_alias> is the alias in the already specified keystore of the private key being used to sign the jar file.
How to verify a signature on a java jar file with jarsigner:
To verify a signed jar file signature with jarsigner, run the following command:
jarsigner -verify -verbose -keystore <codesign.p12> signed.jar
Where jarsigner -verify -verbose is the leading command to verify the signature with verbose output, -keystore <codesign.p12> is the keystore containing the certificate used to verify the signature, and signed.jar is the signed jar file being verified.
Conclusion
Let us know in the comments if you have any questions not answered here or if you would like to see more examples on the installation and use of code signing.
Leave a Reply