Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have an SSL certificate installed and working on my web server. On another project I need to sign some code. Can I use the website SSL certificate to sign code, or is a code-signing certificate fundamentally different?

Searching on Google I see that the code-signing certs are a lot more expensive than website certs but as far as I understand, they're all simply just a bunch of hash codes.

share|improve this question

migrated from serverfault.com Jan 31 at 19:46

This question came from our site for professional system and network administrators.

    
You need a code signing cert. –  Dan Jan 31 at 19:33

2 Answers 2

up vote 1 down vote accepted

A certificate may be issued with several purposes. To make sure you can check the properties of your certificate. For example in windows, if you double-click the *.cer file and go to the details page, you can see the allowed purposes in the list of properties. But if the certificate was created originally "just" for a webserver, the chance is zero that code signing is listed.

share|improve this answer

No. Certificates are issued with specific Purposes encoded into them.
A "website certificate" is for "Server Authentication". It will not work for Code Signing.

share|improve this answer
1  
Specifically it needs the extended key flag 1.3.6.1.5.5.7.3.3 (Server Authentication is 1.3.6.1.5.5.7.3.1 if anyone is curious.) –  Scott Chamberlain Jan 31 at 19:59
    
Thanks for the detail. Although I'm still curious why one costs five times more than the other. I'd have thought the "technology" in both is the same. At the end of the day I thought all certificates are nothing more than key pairs. –  njr101 Jan 31 at 21:20
    
@njr101 theoretically with a code signing certificate more work will be performed to authenticate you are who you actually claim to be. (Like ask you fax in your identification, and so on). For cheap web certificates these days, they just authenticate that you control the DNS servers for that particular domain name. Generally the cost for a cert is strongly related to the amount of effort it takes them to provide the appropriate level of authentication. If you take a look you will see that EV certs are also pretty expensive. –  Zoredache Jan 31 at 23:00
    
@njr101 I buy certs from StartSSL. They only charge to verify who you are (and also company names if you want those), once verified they'll issue as many certificates with that information as you want, including free "server" certs without any personal or company information. Most other CA's treat the certificate itself as a product to be sold, and charge as much as they think they can get away with (that's capitalism at it's finest). –  Chris S Feb 1 at 17:28
    
@Zoredache: Thanks for the info - the price difference makes more sense in that case. The EV certs are certianly a lot more expensive. Thanks for the tip with StartSSL –  njr101 Feb 2 at 13:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.