We have a windows based infrastructure. Recently I was asked by our software developer if we can issue our own certificates to sign some small programs we're sending to out partners. But I don't fully understand process of doing so. What exactly I suppose to set up for us to issue and maintain our own certificates for signing software? Apparently software must be sign due to some security concerns.
Purchasing certificates from a provider like Verisign isn't an option and as far as I understand it's not required for our certificate to be trusted righ away.
How is it done usually? I have a Windows based infrastructure in the company.