Code Signing Certificate Setup Guide: Secure Software Distribution

┌─────────────────────────────────────────────────────────────────────────┐
│              2025 Code Signing Certificate Changes                       │
├─────────────────────────────────────────────────────────────────────────┤
│                                                                          │
│  EFFECTIVE FEBRUARY 1, 2025                                             │
│  ─────────────────────────────────────────────────────────────────────  │
│                                                                          │
│  ┌─────────────────────────────────────────────────────────────────┐   │
│  │  MANDATORY HSM STORAGE                                           │   │
│  │  • All code signing private keys MUST be stored in:             │   │
│  │    - Hardware Security Module (HSM)                              │   │
│  │    - Hardware token (USB, smart card)                            │   │
│  │  • FIPS 140-2 Level 2 minimum certification required             │   │
│  │  • Software key storage NO LONGER PERMITTED                      │   │
│  └─────────────────────────────────────────────────────────────────┘   │
│                                                                          │
│  ┌─────────────────────────────────────────────────────────────────┐   │
│  │  SHORTER VALIDITY PERIODS                                        │   │
│  │  • Maximum certificate validity: 460 days (was 3 years)          │   │
│  │  • More frequent renewals required                               │   │
│  │  • Automation becomes essential                                   │   │
│  └─────────────────────────────────────────────────────────────────┘   │
│                                                                          │
│  ┌─────────────────────────────────────────────────────────────────┐   │
│  │  STRONGER KEY REQUIREMENTS                                       │   │
│  │  • Minimum RSA key size: 3072 bits (was 2048)                   │   │
│  │  • ECDSA P-256 or P-384 also acceptable                         │   │
│  │  • SHA-256 or stronger hash algorithm required                   │   │
│  └─────────────────────────────────────────────────────────────────┘   │
│                                                                          │
│  WHY THESE CHANGES?                                                     │
│  • High-profile key theft incidents (Nvidia, Samsung, Microsoft)        │
│  • Software-stored keys too easily compromised                          │
│  • Shorter validity limits exposure from compromised certificates       │
│  • Stronger cryptography for long-term security                         │
│                                                                          │
└─────────────────────────────────────────────────────────────────────────┘

# Azure CLI setup
az extension add --name trustedsigning

# Create Trusted Signing account
az trustedsigning account create \
    --resource-group myRG \
    --name mySigningAccount \
    --location eastus

# Create certificate profile
az trustedsigning certificate-profile create \
    --account-name mySigningAccount \
    --profile-name Production \
    --profile-type PublicTrust \
    --include-street true \
    --include-city true

# Sign using SignTool with Trusted Signing
signtool sign /v /debug /fd SHA256 \
    /tr http://timestamp.acs.microsoft.com \
    /td SHA256 \
    /dlib "C:\Program Files\Azure\TrustedSigning\bin\Azure.CodeSigning.Dlib.dll" \
    /dmdf metadata.json \
    myapp.exe

# Install Windows SDK (includes signtool.exe)
# Download from: https://developer.microsoft.com/windows/downloads/windows-sdk/

# Or install via winget
winget install Microsoft.WindowsSDK

# Verify signtool is available
& "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\signtool.exe" /?

# EV certificate on SafeNet token (automatic detection)
signtool sign /v /fd SHA256 `
    /tr http://timestamp.digicert.com `
    /td SHA256 `
    /sha1 ABC123DEF456... `
    MyApplication.exe

# For unattended signing, some tokens support PIN caching
# Or use SafeNet Authentication Client with stored PIN

# Sign multiple files
Get-ChildItem -Recurse -Include *.exe, *.dll | ForEach-Object {
    signtool sign /v /fd SHA256 `
        /tr http://timestamp.digicert.com `
        /td SHA256 `
        /sha1 ABC123DEF456... `
        $_.FullName
}

# Install Azure Sign Tool
dotnet tool install --global AzureSignTool

# Sign using Azure Key Vault
AzureSignTool sign `
    --azure-key-vault-url "https://myvault.vault.azure.net" `
    --azure-key-vault-client-id "client-id" `
    --azure-key-vault-client-secret "client-secret" `
    --azure-key-vault-tenant-id "tenant-id" `
    --azure-key-vault-certificate "code-signing-cert" `
    --timestamp-rfc3161 "http://timestamp.digicert.com" `
    --timestamp-digest sha256 `
    --file-digest sha256 `
    --verbose `
    MyApplication.exe

# Drivers require EV certificate and cross-certificate
# Microsoft attestation signing for Windows 10 1607+

# Sign with EV certificate (includes cross-cert)
signtool sign /v /fd SHA256 `
    /ac "DigiCert High Assurance EV Root CA.crt" `
    /tr http://timestamp.digicert.com `
    /td SHA256 `
    /sha1 ABC123DEF456... `
    /ph `
    MyDriver.sys

# Submit to Microsoft Partner Center for attestation signing
# (Required for Windows 10 version 1607 and later)

# Verify signature
signtool verify /pa /v MyApplication.exe

# Verify with detailed output
signtool verify /pa /v /debug MyApplication.exe

# Check timestamp
signtool verify /pa /v /tw MyApplication.exe

# Expected output for valid signature:
# Successfully verified: MyApplication.exe
# Signing Certificate Chain:
#     Issued to: Example Corp
#     Issued by: DigiCert Code Signing CA
# The signature is timestamped: [date]

# Requires Apple Developer Program membership ($99/year)
# Obtain Developer ID certificate from Apple Developer portal

# List available signing identities
security find-identity -v -p codesigning

# Expected output:
# 1) ABC123... "Developer ID Application: Example Corp (TEAM123)"
# 2) DEF456... "Developer ID Installer: Example Corp (TEAM123)"

# Sign application bundle
codesign --sign "Developer ID Application: Example Corp (TEAM123)" \
    --timestamp \
    --options runtime \
    --force \
    --deep \
    MyApp.app

# Verify signature
codesign --verify --verbose=4 MyApp.app
spctl --assess --verbose=4 --type execute MyApp.app

# Create ZIP for notarization
ditto -c -k --keepParent MyApp.app MyApp.zip

# Submit for notarization
xcrun notarytool submit MyApp.zip \
    --apple-id "[email protected]" \
    --team-id "TEAM123" \
    --password "@keychain:AC_PASSWORD" \
    --wait

# Check status
xcrun notarytool log <submission-id> \
    --apple-id "[email protected]" \
    --team-id "TEAM123" \
    --password "@keychain:AC_PASSWORD"

# Staple notarization ticket to app
xcrun stapler staple MyApp.app

# Verify notarization
spctl --assess --verbose=4 --type execute MyApp.app
# Should show: source=Notarized Developer ID

# Sign the DMG
codesign --sign "Developer ID Application: Example Corp (TEAM123)" \
    --timestamp \
    MyApp.dmg

# Notarize the DMG
xcrun notarytool submit MyApp.dmg \
    --apple-id "[email protected]" \
    --team-id "TEAM123" \
    --password "@keychain:AC_PASSWORD" \
    --wait

# Staple
xcrun stapler staple MyApp.dmg

# Sign package
productsign --sign "Developer ID Installer: Example Corp (TEAM123)" \
    --timestamp \
    unsigned.pkg \
    signed.pkg

# Notarize
xcrun notarytool submit signed.pkg \
    --apple-id "[email protected]" \
    --team-id "TEAM123" \
    --password "@keychain:AC_PASSWORD" \
    --wait

# Staple
xcrun stapler staple signed.pkg

# Generate GPG key (if not exists)
gpg --full-generate-key

# Export public key for repository
gpg --armor --export [email protected] > public.gpg

# Sign .deb package
dpkg-sig --sign builder mypackage.deb

# Verify signature
dpkg-sig --verify mypackage.deb

# Configure RPM macros
cat >> ~/.rpmmacros << 'EOF'
%_signature gpg
%_gpg_name Developer <[email protected]>
%_gpg_path /home/developer/.gnupg
EOF

# Sign RPM
rpm --addsign mypackage.rpm

# Verify signature
rpm --checksig mypackage.rpm
rpm -K mypackage.rpm

# Sign with GPG
gpg --detach-sign --armor MyApp.AppImage

# Users verify with
gpg --verify MyApp.AppImage.asc MyApp.AppImage

name: Build and Sign

on:
  push:
    tags:
      - 'v*'

jobs:
  build-and-sign:
    runs-on: windows-latest

    steps:
      - uses: actions/checkout@v4

      - name: Build Application
        run: dotnet build -c Release

      - name: Decode Certificate
        run: |
          $certBytes = [Convert]::FromBase64String("${{ secrets.CODE_SIGNING_CERT }}")
          [IO.File]::WriteAllBytes("cert.pfx", $certBytes)

      - name: Sign Application
        run: |
          & "C:\Program Files (x86)\Windows Kits\10\bin\10.0.22621.0\x64\signtool.exe" sign `
            /f cert.pfx `
            /p "${{ secrets.CERT_PASSWORD }}" `
            /fd SHA256 `
            /tr http://timestamp.digicert.com `
            /td SHA256 `
            .\bin\Release\MyApp.exe

      - name: Clean Up Certificate
        if: always()
        run: Remove-Item cert.pfx -ErrorAction SilentlyContinue

name: Build and Sign with Azure Key Vault

on:
  push:
    tags:
      - 'v*'

jobs:
  build-and-sign:
    runs-on: windows-latest

    steps:
      - uses: actions/checkout@v4

      - name: Azure Login
        uses: azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Build Application
        run: dotnet build -c Release

      - name: Install Azure Sign Tool
        run: dotnet tool install --global AzureSignTool

      - name: Sign Application
        run: |
          AzureSignTool sign `
            --azure-key-vault-url "${{ secrets.AZURE_KEY_VAULT_URL }}" `
            --azure-key-vault-client-id "${{ secrets.AZURE_CLIENT_ID }}" `
            --azure-key-vault-client-secret "${{ secrets.AZURE_CLIENT_SECRET }}" `
            --azure-key-vault-tenant-id "${{ secrets.AZURE_TENANT_ID }}" `
            --azure-key-vault-certificate "${{ secrets.CERT_NAME }}" `
            --timestamp-rfc3161 "http://timestamp.digicert.com" `
            --timestamp-digest sha256 `
            --file-digest sha256 `
            .\bin\Release\MyApp.exe

trigger:
  tags:
    include:
      - v*

pool:
  vmImage: 'windows-latest'

steps:
  - task: DotNetCoreCLI@2
    inputs:
      command: 'build'
      configuration: 'Release'

  - task: AzureKeyVault@2
    inputs:
      azureSubscription: 'Azure-Connection'
      KeyVaultName: 'MyKeyVault'
      SecretsFilter: 'CodeSigningCert'

  - task: DotNetCoreCLI@2
    displayName: 'Install AzureSignTool'
    inputs:
      command: 'custom'
      custom: 'tool'
      arguments: 'install --global AzureSignTool'

  - script: |
      AzureSignTool sign ^
        --azure-key-vault-url "$(KeyVaultUrl)" ^
        --azure-key-vault-managed-identity ^
        --azure-key-vault-certificate "CodeSigningCert" ^
        --timestamp-rfc3161 "http://timestamp.digicert.com" ^
        --file-digest sha256 ^
        "$(Build.ArtifactStagingDirectory)\MyApp.exe"
    displayName: 'Sign Application'

pipeline {
    agent { label 'windows' }

    environment {
        AZURE_CLIENT_ID = credentials('azure-client-id')
        AZURE_CLIENT_SECRET = credentials('azure-client-secret')
        AZURE_TENANT_ID = credentials('azure-tenant-id')
    }

    stages {
        stage('Build') {
            steps {
                bat 'dotnet build -c Release'
            }
        }

        stage('Sign') {
            steps {
                bat '''
                    AzureSignTool sign ^
                        --azure-key-vault-url "https://myvault.vault.azure.net" ^
                        --azure-key-vault-client-id "%AZURE_CLIENT_ID%" ^
                        --azure-key-vault-client-secret "%AZURE_CLIENT_SECRET%" ^
                        --azure-key-vault-tenant-id "%AZURE_TENANT_ID%" ^
                        --azure-key-vault-certificate "code-signing-cert" ^
                        --timestamp-rfc3161 "http://timestamp.digicert.com" ^
                        --file-digest sha256 ^
                        bin\\Release\\MyApp.exe
                '''
            }
        }
    }
}

┌─────────────────────────────────────────────────────────────────────────┐
│                Code Signing Security Workflow                            │
├─────────────────────────────────────────────────────────────────────────┤
│                                                                          │
│  1. BUILD                                                               │
│  ┌──────────────────────────────────────────────────────────────────┐  │
│  │ • Build from verified source control                              │  │
│  │ • Use reproducible builds                                         │  │
│  │ • Lock dependency versions                                        │  │
│  │ • Scan dependencies for vulnerabilities                           │  │
│  └──────────────────────────────────────────────────────────────────┘  │
│                              │                                          │
│                              ▼                                          │
│  2. PRE-SIGN VERIFICATION                                              │
│  ┌──────────────────────────────────────────────────────────────────┐  │
│  │ • Static analysis (SAST)                                          │  │
│  │ • Malware scan (multiple engines)                                 │  │
│  │ • License compliance check                                        │  │
│  │ • Binary verification (no unexpected changes)                     │  │
│  └──────────────────────────────────────────────────────────────────┘  │
│                              │                                          │
│                              ▼                                          │
│  3. SIGNING                                                            │
│  ┌──────────────────────────────────────────────────────────────────┐  │
│  │ • HSM-protected signing key                                       │  │
│  │ • Multi-party authorization for production                        │  │
│  │ • Timestamp from multiple TSAs                                    │  │
│  │ • Audit logging of all signatures                                 │  │
│  └──────────────────────────────────────────────────────────────────┘  │
│                              │                                          │
│                              ▼                                          │
│  4. POST-SIGN VERIFICATION                                             │
│  ┌──────────────────────────────────────────────────────────────────┐  │
│  │ • Verify signature is valid                                       │  │
│  │ • Verify timestamp is present                                     │  │
│  │ • Test on clean system                                            │  │
│  │ • Record hash for future verification                             │  │
│  └──────────────────────────────────────────────────────────────────┘  │
│                                                                          │
└─────────────────────────────────────────────────────────────────────────┘

# Scan with multiple engines before signing
# Example: VirusTotal API

#!/bin/bash
FILE="$1"
API_KEY="${VIRUSTOTAL_API_KEY}"

# Upload file
RESPONSE=$(curl -s --request POST \
    --url 'https://www.virustotal.com/api/v3/files' \
    --header "x-apikey: ${API_KEY}" \
    --form "file=@${FILE}")

ANALYSIS_ID=$(echo "$RESPONSE" | jq -r '.data.id')

# Wait for analysis
sleep 60

# Get results
RESULT=$(curl -s --request GET \
    --url "https://www.virustotal.com/api/v3/analyses/${ANALYSIS_ID}" \
    --header "x-apikey: ${API_KEY}")

MALICIOUS=$(echo "$RESULT" | jq '.data.attributes.stats.malicious')

if [ "$MALICIOUS" -gt 0 ]; then
    echo "WARNING: $MALICIOUS engines detected malware!"
    exit 1
fi

echo "Clean: proceeding with signing"

# Use multiple timestamp servers for redundancy
$timestampServers = @(
    "http://timestamp.digicert.com",
    "http://timestamp.sectigo.com",
    "http://timestamp.globalsign.com",
    "http://tsa.starfieldtech.com"
)

$signed = $false
foreach ($ts in $timestampServers) {
    try {
        signtool sign /v /fd SHA256 `
            /tr $ts `
            /td SHA256 `
            /sha1 ABC123... `
            MyApp.exe

        $signed = $true
        Write-Host "Signed with timestamp from: $ts"
        break
    }
    catch {
        Write-Host "Timestamp failed from $ts, trying next..."
    }
}

if (-not $signed) {
    throw "All timestamp servers failed!"
}

┌─────────────────────────────────────────────────────────────────────────┐
│              Test vs Production Signing                                  │
├─────────────────────────────────────────────────────────────────────────┤
│                                                                          │
│  TEST ENVIRONMENT                  PRODUCTION ENVIRONMENT               │
│  ─────────────────────────────────────────────────────────────────────  │
│                                                                          │
│  ┌─────────────────────┐          ┌─────────────────────┐              │
│  │ Self-Signed Cert    │          │ EV Code Signing     │              │
│  │ or Test CA          │          │ Certificate         │              │
│  └─────────────────────┘          └─────────────────────┘              │
│                                                                          │
│  • Different key from prod        • HSM-protected key                   │
│  • No SmartScreen impact          • Multi-person authorization          │
│  • Automated in CI                • Approval gate required              │
│  • Short validity                 • Full audit logging                  │
│  • Test systems only              • Customer-facing releases            │
│                                                                          │
│  NEVER use production signing key for:                                  │
│  • Development builds                                                   │
│  • Testing/QA builds                                                    │
│  • Internal tools not for distribution                                  │
│                                                                          │
└─────────────────────────────────────────────────────────────────────────┘

# Create code signing CA (using private PKI)
# See: PKI Certificate Authority Setup Guide

# OpenSSL config for code signing template
cat > codesigning.cnf << 'EOF'
[req]
distinguished_name = req_dn
x509_extensions = v3_code

[req_dn]
CN = Internal Code Signing

[v3_code]
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature
extendedKeyUsage = critical, codeSigning
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
EOF

# Generate code signing certificate
openssl req -new -nodes \
    -keyout codesigning.key \
    -out codesigning.csr \
    -subj "/CN=Internal Code Signing/O=Example Corp"

openssl ca -config /etc/pki/issuing-ca/openssl.cnf \
    -extensions v3_code \
    -in codesigning.csr \
    -out codesigning.crt

# Create PFX for Windows
openssl pkcs12 -export \
    -inkey codesigning.key \
    -in codesigning.crt \
    -certfile ca-chain.crt \
    -out codesigning.pfx

# Windows: Deploy via Group Policy
# Import to Trusted Publishers and Root

# PowerShell deployment
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("root-ca.crt")
$store = New-Object System.Security.Cryptography.X509Certificates.X509Store("Root", "LocalMachine")
$store.Open("ReadWrite")
$store.Add($cert)
$store.Close()

$signingCert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("codesigning.crt")
$pubStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("TrustedPublisher", "LocalMachine")
$pubStore.Open("ReadWrite")
$pubStore.Add($signingCert)
$pubStore.Close()