We have a windows based infrastructure. Recently I was asked by our software developer if we can issue our own certificates to sign some small programs we're sending to out partners. But I don't fully understand process of doing so. What exactly I suppose to set up for us to issue and maintain our own certificates for signing software? Apparently software must be sign due to some security concerns.

Purchasing certificates from a provider like Verisign isn't an option and as far as I understand it's not required for our certificate to be trusted righ away.

How is it done usually? I have a Windows based infrastructure in the company.


You can setup a Microsoft certificate authority but this probably won’t work for what you are trying to accomplish. A Microsoft Certificate server could be used to sign the code for use inside your network as you can have all the machines trust the certificate authority. This will not help others trust your app as the developer without being signed from a provider like Verisign.

Here is a post on signing Windows 8 apps with an internal PKI, but again this works for internal apps not external. http://blogs.technet.com/b/deploymentguys/archive/2013/06/14/signing-windows-8-applications-using-an-internal-pki.aspx


I really don't think you'll be able to accomplish what you want without getting a proper, recognized 3rd party code-signing certificate.

Verisign isn't the only issuer of such certificates; shop around and you'll find better prices.

As for the signing process, I use MS Signtool in the manner described here: https://stackoverflow.com/questions/2718776/how-do-i-sign-exes-and-dlls-with-my-code-signing-certificate


You can definitely create your own CA and ship that CA to your clients, who will have to install it as a trusted CA on all the computers they use to run your software. You'll have to manage (and guard very closely) the CA key, and convince each of your customers to do this with you (those with anything resembling a security policy will flatly refuse), and provide detailed instructions, and support it.

If you use an untrusted certificate, generally Windows makes more noise than if you don't sign your binaries at all.

Seriously, don't rule out buying one of these. If you go with a provider like StartCom, you can have one for around $120 maximum per 2 years. This is way cheaper than dealing with signing it yourself even if all your staff were paid minimum wage.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.