I'd like to experiment with signing a software executable. I am afraid that there is something that escapes me.
I will get to the point where I will acquire a certificate from a CA, but before then I would like to know what I am doing, so I did a test:
I created a self-signed certificate:
makecert -r -ss myPrivateCert -sk c:\test -n "CN=My Company Inc." testCert.cer
then signed an executable:
signtool sign /v /s myPrivateCert /n "My Company Inc." /t http://timestamp.verisign.com/scripts/timstamp.dll c:\folder\my_installer.exe
For both commands, I got success.
Step 3: "Install the Test Certificate": http://msdn.microsoft.com/en-us/library/bb756995
Success.
(Note: in the folder c:\test
, I placed certificates downloaded from Microsoft's suggested cross-certificate list, like VeriSign Class 3 Public Primary Certification Authority - G5.cer
- I'm just guessing that I was supposed to do that.)
I run certmgr c:\folder\my_installer.exe
and I got a list of 3 certificates I had added, with Subject, Issuer, , Serial Number... (from My Company Inc. and Verisign), so apparently everything is good.
Even after that, if I double click the installer (or the executable), I get the UAC message about Unknown publisher...
So what else do I need to do to have that box either disappear or say "My Company Inc." for producer ? And that is only for the local machine, doing everything by hand...
For testing for real, I am assuming that my client is a VirtualBox environment... so ? The next step: move the installer in a VirtualBox and run it ?
But how do I tell the client about the key or certificate or whatever ? Do I copy the cer file along with the exe ? Do I have to put it in a special place ? Do I copy any other files ? Do I have to run mmc again ? Will users have to do something like that ? Because it seems exceedingly complicated, from a user perspective... This is very confusing...
I am assuming that, if I purchase a real certificate from Verisign for example, it would authenticate over the web and I would not have to do anything else (except the two commands above, minus the -r) ?
I have found lots of directions about this on the web, but each left me as confused as when I started - perhaps they each had assumptions of some prior knowledge...