Introduction

Code Signing Certificates are a means for developers on all platforms to digitally sign their applications and software that they make available over the internet. Signed code is marked with the name of the publisher, providing protection against the introduction of malware and other subsequent modifications.

All Code Signing Certificates use a unique cryptographic hash to bind the identity of the publisher to the software. Security warnings displayed for unsigned code are replaced with information about the publisher of the software. This helps prevent users from aborting the installation out of uncertainty. Code signing therefore adds an important level of trust to the installation process.
Code signing shows that the signed software is authentic, comes from a known software vendor and that the code has not been modified since it was signed. Code signing helps to alleviate users’ security concerns, reducing the number of installation abortions. It also prevents  the code from being changed with malicious intent or the identity of a trusted software vendor from being misused by others.

Feature overview

Here is a brief overview of the features included for Code Signing Certificates:

• A single Code Signing Certificate for all applications:
• Microsoft Authenticode
• Adobe AIR
• Apple OS X
• SunJava
• Mozilla & Netscape Objects
• Macros & VBA
• Eliminates "Unknown Publisher" security warnings when downloading code
• Due to the time stamp service, the signature does not expire, even if the certificate expires
• Signs an unlimited number of applications
• Protects your brand and reputation
  

*With an OV Code Signing Certificate, Microsoft SmartScreen requires a certain reputation of the files, e.g. a specific number of downloads. Only then is the signature fully classified as trustworthy.

Ordering a Code Signing Certificate

Enclosed are some brief overviews of the process flow for ordering code signing.

DigiCert

1. Orders are carried out via our systems
2. Verification of the company takes place on the basis of the commercial register entry and a telephone verification
3. Select the provisioning method:
   1. Own compliant HSM
      → SafeNet eToken 5110 FIPS (ECC P-256 or P-384)
      → SafeNet eToken 5110 CC (RSA 4096 ECC P-256)
      → SafeNet eToken 5110+ FIPS (RSA 4096 ECC P-256)
   2. Hardware token from the CA with costs (including shipping)
4. The hardware token with the pre-installed certificate or an e-mail with a download link is sent out. The hardware token can no longer be cancelled
5. After the successful issuing of the certificate, the so-called Hardware Init Code is visible in our system under the certificate details.
   You need this initialization code for the installation with the DigiCert Hardware Certificate Installer
6. With the own HSM, the certificate must be installed on the token

Sectigo

1. Orders are carried out via our systems
   A CSR is always requested by our system, but is only forwarded to the CA if the provisioning method 3a (see below) has been selected, otherwise the CSR is discarded.
   If CN is filled in and not empty, Sectigo requires a domain name as value (otherwise error). If the CSR is created on the YubiKey or Luna hardware, the company name is not stored in the CN but in the subject and therefore does not lead to an error in the Sectigo backend.
   
2. Verification of the company takes place on the basis of the commercial register entry and a telephone verification
3. Select the provisioning method:
   1. Own compliant HSM with key attestation and CSR
      → YubiKey 5 FIPS Series
      → Luna Network Attached HSM, Version 7.x
      
   2. Hardware token from the CA with costs (including shipping)
4. The hardware token with the pre-installed certificate or an e-mail with a download link is sent out. The hardware token can no longer be cancelled
5. With the own HSM, the certificate must be installed on the token

GlobalSign

1. Orders are carried out via our systems
2. A pickup password is mandatory to place an order
3. Verification of the company takes place on the basis of the OV or EV guidelines
4. The USB token is sent by a service provider located in Germany
5. The email with download link is sent simultaneously
6. After receiving the USB token, the certificate is downloaded via the SafeNet Authentication Client with link and password.
   The certificate must be retrieved within 7 days after a reissue and within 30 days after create/renew, otherwise the certificate will be canceled and cannot be used. 
   
7. After installation, the certificate is ready for use. More Information for the Installation can be found here.

General notes

For some applications, it may be necessary to convert the delivered Code Signing Certificate. Use tools like the MS SSL ToolKit for this.
Instructions for using the included time stamp function can be found under the following links:

Depending on the CA, the delivery of the Code Singing Certificate varies. 
Please note that software may have to be installed locally to install the certificate and that there may be restrictions due to the respective operating system.