We tried to get a code signing certificate for an application. The only business address is the owners home address, and a few other complications that were becoming difficult to satisfy Comodo. We also have a PO box, but that was not acceptable to use on the white page listings that they required we have. Does anyone know of a code signing company that doesn't require so many things to be arranged this way?
Depending on who your users are, you could go with a self-signed certificate. They're free and don't require an address. The down-side is that browsers will display a warning that the certificate is not trusted.
If that creates a problem for you, then you'll probably have to provide a physical address. All of the signing authorities I'm aware of require one.
Related
As I can see, in Windows, the Digital Signature tab of an EXE file will show the Company Name, City Name, and Country Name of the company.
Is the user able to find the detailed address of the company from the signature? The situation is the same for OV and EV code signings?
Thank you.
Information appearing on the Digital Signature tab come from the 'Subject' field of the certificate.
This information is provided by the company when signing keys are generated.
Then, those keys are used to generate a Certificate signing request (CSR) who contains this information + public key.
This is this CSR who is transmitted to the certificate authority.
The certificate authority will then sign digitally the certificate with his proper key, after validation of information present on the CSR. It will not add any further information about the company, only validate and sign. The validation process of the company by the authority will be different for OV or EV, but information present on the certificate stays those provided by the company on the CSR.
The detailed address of the company will appear only if it was provided when signing keys were generated.
This is not typical information required on a certificate, but the company can choose to add personalized information on the Subject field.
I am not aware of any certificate authority who require the detailed address on CSR.
I don't believe so as it would not be very secure to display the company's detailed information. This could lead to someone breaking in or harassing workers where Microsoft could be blamed as they let the company's address go public.
Data about an exe file made with visual studio is created like this inside the AssemblyInfo.cs (in C# projects) in the properties. This is all the data that can be found if I'm correct. Every application made in visual studio will have something like this, I'm not sure about C++ projects, but it should be something around the lines like this.
I got the error NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM when accessing one website using Chrome browser on macOS. The url of the website is corporate / internal so I can't paste the url here (you won't have access anyhow).
Chrome version 75.0.3770.142.
macOS version is Mojave (10.14.4).
Chrome devtools Security tab show 2 errors:
Certificate - insecure (SHA-1) : The certificate chain for this site contains a certificate signed using SHA-1.
Certificate - missing : This site is missing a valid, trusted certificate (net::ERR_CERT_WEAK_SIGNATURE_ALGORITHM).
I can bypass the warning, but it come back after each page change/page refresh (so boring).
I know why the warning 1 is shown: the leaf certificate is signed with a certificate which signature algorithm is SHA-1 with RSA. Chrome detects this as weak. (I'm ok with this behavior)
I guess the warning 1 implies the warning 2: the leaf certificate can't be trusted.
The things I don't understand are:
why I don't have the problem using Firefox, on the same macOS computer
why I don't have the same problem using Chrome, same version, from another macOS computer
why I don't have the same problem using Chrome, same version, from a Windows computer
As a side note, Chrome on Windows computer show the same Certificate - insecure (SHA-1), but the warning 2 ERR_CERT_WEAK_SIGNATURE_ALGORITHM is not present.
This drives me crazy !
Does anyone have an idea on this ?
Does anyone knows how/when/why those warnings are raised ? (I may look into Chromium source code but I don't know if Chromium handles this mecanism)
I really don't understand why there are such different behavior on configurations that looks similars...
Thanks for your help,
Romain
The URL is corporate, so the certificate is signed by your corporation. This is normal for many corporative sites/intranets.
Chrome assumes SHA1 is weak, but this is OK. It is the company certificate for the corporative intranet (i am assuming it is an intranet URL, or alike), so no problem it uses SHA1.
The site is missing a valid trusted certificate, means the current URL certificate could not be validated by any worldwide authority (this is normal, it was created by the intranet admin, internally, for internal use), and then the message is warning you that it is not trustable: Not trustable here means your computer does not know what to do, it tried check it to validate via internet if it could be trusted but it couldn't find any authority who replied, so the warning is for you to take some action (ignore, avoid the url, check the certificate, or trust it)
Solution:
On MacOS you have to add that certificate to the KeyChain, this way you are intentionally telling the operating system and any application who need to verify the certificate that it is trustable.
To do it:
open the certificate by clicking "View Certificate" on Chrome (like it is on your image above)
Once it is opened, click on its square drawing (difficult to explain this, I will put a picture below), and
Drag the certificate to your desktop (or any folder, this is temporary)
Go to finder, double click the certificate you just saved, you will se a dialog box like the image below:
Click Add (keychain must be login, like the above image)
Keychain Utility should open automatically at this point, if it doesn't, open KeyChain Utility on your Mac. Locate the certificate inside the Login Keychain (example picture below)
You'll see it was added, but yet not trusted. So we will tell the system we trust it, and by trusting it applications like Chrome and Safari will not display that warning anymore. Because they will check that the system trust that certificate for SSL connections.
Double Click it on the Keychain, it will open, click the little triangle to expand "Trust" item.
Select the item "Secure Sockets Layer (SSL)", and put the value "Always Trust"
Close the certificate by clicking on the red X button on its window. It will ask for your password to save the new settings for the certificate.
Put your password, click Update Settings
It will now show a blue icon, along with a message telling it is marked as trusted for your account.
This is it.
The Chrome messages will disappear because now that certificate is trusted.
Note: You may be thinking now... "I never did it on the other Mac" and you explained that you don't have that problem on Chrome on that other Mac. I suppose on the other Mac you have accessed that corporative URL using Safari at least once. When you access via Safari it will present you a similar warning like Chrome does, but if you ACCEPT it on Safari, it automatically does all this tutorial procedure for you transparently: it just ask if you want to proceed anyway, you click "proceed", Safari asks you for your password then it put the certificate on the keychain and mark it as trusted [exactly like we did] but transparently. And the next time you access the corporate URL you will not be asked because its certificate is already trusted on your keychain. Later if you then access it using Chrome it will not ask you, because it will see that the keychain already has that corporate certificate as trusted.
This is very probably why your other Mac does not have this situation.
PS: I could have answered here just: Access it using Safari, accept and proceed, and it will never ask again. But this would not be the correct answer. It would not explain the reason, and would be out of your presented scenario. So since you are using Chrome, I described this procedure considering the exact application and the exact situation that you have presented here, clarifying the reasons behind it.
Of course, now, since you know there is 2 ways to make this certificate installation procedure, you can opt for the one you like better.
_
Note: as mentioned by #patrick-mevzek
"On MacOS you have to add that certificate to the KeyChain", and you
will need to to it again each time the certificate changes or is
renewed. And if signed by a private CA, and if you add the CA in the
trust store, you are then open to various MitM attacks, as this CA can
sign certificates for any name, which is/may typically be the standard
setup inside corporate PKIs, but you have to be aware of consequences.
"
I agree with #patrick-mevzek, he is right and he made an important observation on this topic.
I'm extending the point he mentioned (specifically for MacOS) by showing how you can check if the corporate certificate you are about to add to your keychain is a CA Certificate or just a common innofensive end-to-end SSL certificate.
Open that certificate again, scroll down the information of it, until you find the item "usage" as shown on the picture below.
On the image below, there are 2 kind of certificates:
on the left, there is a CA Certificate: it can be used as MitM decryptor if your company wanted. It would only require a proxy between you and the internet, where your browser traffic would passes through. And if you have this kind of certificate trusted on your keychain, you have to be aware that the company proxy can (if a malicious admin wanted) decrypt your encrypted HTTPS traffic and log every confidential information on your connection to anywhere.
on the right, there is a simple and common SSL Certificate used by all of websites and internet domains, its purpose is just end-to-end encryption between you and the visited domain, to encrypt your traffic. It cannot be used as a MitM decryptor of your connection traffic data. This kind is totally safe to be trusted on your keychain.
Let's consider that you have the dangerous case, which the certificate is a CA Certificate and you added and trusted it.
Is there a way for you to know if your traffic is being decrypted by your company and your information being exposed?
Yes, there is.
On any browser, when you are accessing any important site, choose a bank for example, for this example I am choosing "hsbc.com.br", and I will show both situations:
The normal end-to-end encryption as it always must be
The MitM situation decrypting the banking sensitive private data.
While accessing any important https site, even if you see the Green icon on chrome or safari telling the connection is encrypted, check the certificate of it if you want to be sure that nobody is in the middle.
_
Here is the normal & SECURE situation:
HSBC Certificate is issued by DigiCert Inc and also is of type EV, which offer stronger guarantee of identity.
Now lets put a proxy in the middle, and do the MitM atack.
Here is the same HSBC bank I just acessed minutes ago, but I inserted a MitM proxy technic on my network, and I trusted that kind of certificate [CA Certificate] on my MacOS keychain.
Let's see what Chrome tells about the banking website:
It is telling me that it is secure, and also says that my information will be private!
But Chrome is WRONG!! (And it doesn't know it is wrong, because it is beyond it)
Lets open the certificate again: (I just activated the proxy and reloaded the page)
It is easy to notice the difference, the fake HSBC certificate was issued by my own personal certificate authority inside my network. This was done automatically by my proxy, which is capable of reading all the information I insert on the HSBC bank website, in pure TXT format, in both ways. Then it encrypts the data again and send to my Browser, and vice versa, do the same re-encryption while talking to HSBC servers.
The browser "think" that everything is OK, because the connection is encrypted, the site name on the certificate MATCHES the URL address I am accessing, the certificate is valid, and the CA Authority it is trusted on my keychain!
Everything technically is fine, except that is not.
This is the real danger, exposed, as mentioned by #patrick-mevzek that you have to be aware.
I have 2 code signing certificates, for both CSR is created same way, also import and export is done same way. The only difference that I see is that one of certificates Common name contains Quotes, and the other doesn't.
e.g.
some cert and
some "cert"
CSR creation
Request format PKCS #10
disabled "Strong private key encryption"
Entered Common name, Organization, Locality, State, Country
2048 bytes for private key
set private key exportable
Import
place all certificates in Personal store
Export
Include all certificates if possible
Enable certificate privacy
encryption algorithm TripleDES-SHA1
Misleading thing is that this Common name value is NOT taken from the value I entered when I created CSR request
I am using those certificates to sign Winforms applications in Visual Studio. Certificate without Quotes in common name is working correctly (i.e. when I install application user is not getting security warning about unknown publisher), but when I install application which is signed with the other Code signing certificate (with Quotes in Common name) - it does not recognize Publisher. No error when published my application. When I take a look at setup.exe properties in Windows Explorer I see a Digital signatures tab which contains row for my certificate.
I tried to sign files with signtool and then verify - it said that certificate is valid.
I tried to get help from godaddy.com where I bought my certificate, they said that it should work with quotes, too, but didn't offer help to solve the issue. Rekey also didn't help.
I see that there are some suggestions to use Pre Publish, Post Build tasks, but I am not using those for my first certificate which is working.
So, is anyone here using code signing certificate for Winforms application with common name having quotes in it? Or maybe anyone knows about this problem and how to solve it?
Had to revoke (common name which is entered when creating CSR is not taken into account, so rekeying is not enough!) my code signing certificate and create from start without quotes/brackets in company name.
So this means, you will have to wait again for few days, because verification process is made from start again. When you will be contacted by issuer, they will verify / ask you about company name - make sure that they do not include quotes/brackets.
Revoking means that you will basically have to buy your certificate once more, because after you revoke it (at least in godaddy case) in your account you don't have options to create it again. So, you have to contact support (use call center and not chat ;)
So for a long while i have been trying to create a chain of trust in Go.
I used this code to create the certificate https://golang.org/src/crypto/tls/generate_cert.go
But if i set the isCA to false the certificate file in the browser will be empty and my browser will display an error saying: SEC_ERROR_UNKNOWN_ISSUER. How can i specify where it should check the certificate?
I looked at alot of examples but still don’t really understand how it should work. I tried using my own generated server CA and pasted a random intermediate CA under it but it doesn’t know where to check. I know it will deny the certificate, but i’m just trying to understand how the chain works in Go. I don’t know how to use a chain certificate in Go should i use the issuer in template or subject or aren’t those important etc. Does anyone have a example or could point me in the right direction? Thanks.
This is what i am trying to achieve (doesn’t matter if the rootCA is self signed it’s just for testing purposes)
Click for image
i.e. I just want them to be permanently accepted all the time.
No, you cannot. Other people answering this question, please read it more closely. He wasn't asking how to add an exception, or fix a broken certificate. He wanted to TURN OFF THE CHECK COMPLETELY.
The Mozilla people erred on the side of caution by making this impossible. On the one hand it's annoying, but on the other hand, their security mindset is one of the reasons Firefox is so much safer than IE.
If you want to make exceptions just a little bit easier, type "about:config" in the address bar (no quotes), and type browser.ssl_override_behavior into the Filter, double-click the "Value", and change it to "2". Now exceptions require one less click.
check out the perspective firefox addon. It makes firefox 3 automatically accept self-signed certificates.
http://www.cs.cmu.edu/~perspectives/
Here's the answer!
* Tools -> Options -> Advanced -> Encryption -> View Certificates
* Under Authorities tab, enter "RSA Security 1024" in the Search textbox.
* Select RSA Security 1024 V3 and press the Edit button.
* Uncheck all three options
* Press OK and close out the rest of the dialogs.
The certificate authority won't be trusted for anything, and so have been effectively disabled.
The certificate authority is not unknown or in malicious hands or anything, its just not in use and hasn't been audited. See http://blog.mozilla.com/security/2010/04/06/removing-the-rsa-security-1024-v3-root/
You need to import the certificate issuers certificate so that any other certs. issues by that issuer don't give this warning.
In firefox go to:
prefs
advanced
encryption
view certificates
authorities
and then click import
If you have a root certificate for your issuer you can import it here and never see that error again.
For those of us who either...
Don't trust one of hundreds/thousands built-in "authorities" (which occasionally found to be on the list "by accident", or can be used for outrightly malicious purposes - think goverments) and/or security policies of any of them (any single compromised key can forge silent "all clear" for any site, after all, and - surprise - they do).
Don't like the cool tradeoffs like five clicks to get any cryptographic protection against casual listener on a site which somehow didn't paid it's ssl tax (and no, you can't know in advance whether owner actually did that and you're victim of MitM attack)... hm, you can actually buy an item and pay for it in less than that in a sensible UI.
Don't want to take part (for some mysterious reason) in all this commercial "pay or we'll spam you to death" circus altogether (which apparently can be mistaken for security).
Have need to connect to lots of various router/server https interfaces which generate their certificates.
...
...partial solution can be a "MitM me" extension, which at least lowers the click count.
I know it's an old thread, but for future reference, this FF extension makes the trick:
https://addons.mozilla.org/en-US/firefox/addon/skip-cert-error/
I think you need to get the certificate issued by a "root certificate authority" that the browser will know in advance, e.g. Verisign.
http://www.verisign.co.uk/ssl/ssl-information-center/
There's other suppliers too. Trail ones available here....
http://www.geotrust.com/
Good description of the issue and what might work best for you depending on your requirements here...
http://www.boutell.com/newfaq/creating/whichcert.html