Contents
How do I secure a code signing certificate?
Consider the following code signing best practices:
- Minimize access to private keys.
- Protect private keys with cryptographic hardware products.
- Time-stamp code.
- Understand the difference between test-signing and release-signing.
- Authenticate code to be signed.
- Virus scan code before signing.
What are some methods for protecting signing keys?
Protect private keys
- Limit access to keys.
- Physically secure the key storage device in a locked container.
- Use a strong password for private key.
- Secure storage for private key.
- Test Signing certificate vs Release Signing certificate.
Why is it important to protect signing keys?
Signing code without protecting your cryptographic keys and certificates can actually expose you to more risk than no code signing at all. Attackers seek to compromise these digital certificates and keys to sign and distribute malicious code masked as legitimate software or firmware.
What is signed code in security?
What’s Code Signing? Code signing is a digital signature added to software and applications that verifies that the included code has not been tampered with after it was signed.
How can a user protect his her private keys?
A CA’s private key should be stored in hardware-based protection, such as a Hardware Security Module (HSM). This provides tamper-resistant secure storage. A Private key for an end entity could be stored in a Trusted Platform Module (TPM) chip or a USB tamper-resistant security token.
How do I protect my public keys from tampering?
Keep a trusted backup copy of your public key ring and your secret key ring on write-protected media. Since your own trusted public key is used as a final authority to directly or indirectly certify all the other keys on your key ring, it is the most important key to protect from tampering.
How can I get a signed code?
To get an individual code signing certificate, you must:
- Purchase your code signing certificate.
- Satisfy the identity validation/authentication requirements. This process helps you prove that you are who you say you are to the issuing CA.
- Generate and install your code signing certificate.
- Sign your code.