i am interested in buying a Microsoft Code Signing Certificate for a kernel mode driver.
My first question is : are Verisign or Globalsign Certificates mandatory ?
They are expensive and i have found another provider called Digicert with only 178$ the first year.
Here is an old question of stackoverflow :
Kernel mode code signing
And here is the link to digicert page :
http://www.digicert.com/code-signing/driver-signing-in-windows-using-signtool.htm
My second question is how long will the users be able to run the application.
If the certificate expires does it mean that the users will not be able to run the application or only that i cannot compile and sign again another executable but that the application will run ?
Thank you
Alex
DigiCert certificates can absolutely be used for kernel mode signing - VeriSign & GlobalSign aren't mandatory, but they may have been the only ones supported at the time of the linked post. DigiCert officially announced kernel mode signing capabilities in February (http://www.digicert.com/news/2012-02-28-kernel-mode-code-signing.htm).
For your second question - you won't be able to sign new trusted applications after the certificate expires, but users can continue running the application if it was timestamped when it was signed.
DigiCert's instructions on timestamping can be found at http://www.digicert.com/code-signing/signcode-signtool-command-line.htm.
In full disclosure, I'm the VP of Marketing at DigiCert. Saw this post come up and thought I could help :-). If you have any other questions, feel free to reach out to our support team 801-896-7973.
Related
My company distributes an installer to customers via our website. Recently when I download via the website and try to run the installer I get the warning message:
Windows protected your PC
Windows Defender SmartScreen prevented an
unrecognized app from starting. Running this app might put your PC at
risk.
If I right-click on the installer and choose Properties I note the following:
Our installer is signed.
How do I find the reason for the Windows Defender SmartScreen warning?
I have not managed to find any log file for Windows Defender nor found anything in the Event Viewer.
TL;DR
This warning is shown if your app doesn't have enough reputation with Microsoft SmartScreen yet. In order to gain reputation, you can either
submit your app for malware analysis to Microsoft,
buy an "Extended Validation" code signing certificate,
buy a standard code signing certificate, or
just wait for a long time.
Read on for the details about these different options.
Option 1: Submit your app for malware analysis to Microsoft
Microsoft allows software developers to submit a file for malware analysis. According to Microsoft, this will help developers to "validate detection of their products". If the review was successful, the Microsoft SmartScreen warnings will go away faster, or sometimes even instantly (it worked instantly for one of my own apps). You need to have a Microsoft account to submit your app for review.
However, note that if you release an updated version of your app, then you'll also have to request a new review again. To overcome this problem, you'll either have to use an "Extended Validation" or a standard code signing certificate (see below).
Option 2: Buy an "Extended Validation" code signing certificate
A guaranteed way to immediately and permanently get rid of the Microsoft SmartScreen warnings is to buy an "Extended Validation" (EV) code signing certificate from one of the Microsoft-approved certificate authorities (CA's), and to sign your app with that EV certificate.
Such an EV certificate will cost you somewhere between 250 and 700 USD per year, and will only be issued to registered businesses. If you're a single developer, you must be a sole proprietor and have an active business license. You can read more about the formal requirements for EV code signing certificates in the EV Code Signing Certificate Guidelines.
An EV certificate will typically be shipped to you by physical delivery on a hardware token.
Option 3: Buy a standard code signing certificate
You can also buy a cheaper "standard" (i.e. non-EV) code signing certificate, and sign your app with that certificate. This will also permanently, but not instantly, make the Microsoft SmartScreen warnings disappear. Standard code signing certificates will cost you between 100 and 500 USD per year, and can also be issued to private developers without an active business license. Some CA's also offer discounts for open source projects.
No instant solution
The problem with standard code signing certificates is that they do not instantly silence Microsoft SmartScreen. Instead, some time will be needed for your certificate to build reputation before the warning will go away. However, once your certificate has built enough reputation, all applications signed with that certificate will be permanently trusted by Microsoft SmartScreen and won't trigger the warning anymore.
How long will it take?
So, how long will it take until the Microsoft SmartScreen warning will disappear when using a standard code signing certificate? Unfortunately, this is difficult to answer, since Microsoft itself refuses to publish any details about this. According to inofficial numbers reported by various sources (see below), it usually takes between 2 and 8 weeks until the warning will permanently go away. It seems that the exact duration also depends on the reputation of the website from which your app is downloaded.
The inofficial numbers are:
18 days and about 430 app installs. Source: one of my own certificates (Dec 2022)
42 days and about 1.400 app installs. Source: one of my own certificates (Feb 2021)
16 days and about 2.000 app installs. Source: one of my own certificates (May 2020)
One month and more than 10.000 downloads. Source: here (Jan 2020)
Between a few weeks and a month. Source: here (Dec 2019)
About 2-3 weeks. Source: here (Dec 2019)
About 3.000 downloads. Source: here (Dec 2013)
The problem of certificate rollover
Certificate rollover occurs when your old certificate expires and you begin signing your code with a renewed certificate.
It's a good idea to buy your standard code signing certificate with the longest possible validity period because when you renew your certificate, the reputation will unfortunately not automatically carry over to the renewed certificate (not even if it's signed against the same private key as the old certificate).
However, you can mitigate the rollover problem by getting your renewed code signing certificate before your old certificate expires, and then using both the old (but not yet expired!) and the renewed certificate to sign your code, resulting in two signatures. The signature from your old certificate will continue to bypass SmartScreen and, at the same time, the new signature will help the new certificate to build up trust. So, the idea is that your new certificate becomes trusted before your old certificate expires.
If your old certificate should already have expired, then you can (and should!) still add the signature from your renewed certificate to an already released version of your app, in order to gain reputation for the renewed certificate.
To correctly dual-sign your app, first sign your code with the old certificate, and then sign it again with the renewed certificate, using the /as command line option of Microsoft's SignTool to append an additional signature to the first one (instead of replacing it).
Option 4: Just wait for a long time
If you don't take any measures at all, the Microsoft SmartScreen warning will also go away eventually. This might however take a ridiculous amount of time (months) and / or downloads (tens of thousands). Another big problem is that each time you'll release an updated version of your app, the waiting period will start all over again. So, this probably isn't the solution you're looking for.
After clicking on Properties of any installer(.exe) which block your application to install (Windows Defender SmartScreen prevented an unrecognized app ) for that issue i found one solution
Right click on installer(.exe)
Select properties option.
Click on checkbox to check Unblock at the bottom of Properties.
This solution work for Heroku CLI (heroku-x64) installer(.exe)
If you have a standard code signing certificate, some time will be needed for your application to build trust. Microsoft affirms that an Extended Validation (EV) Code Signing Certificate allows us to skip this period of trust-building. According to Microsoft, extended validation certificates will enable the developer to immediately establish a reputation with SmartScreen. Otherwise, the users will see a warning like "Windows Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk.", with the two buttons: "Run anyway" and "Don't run".
Another Microsoft resource states the following (quote): "Although not required, programs signed by an EV code signing certificate can immediately establish a reputation with SmartScreen reputation services even if no prior reputation exists for that file or publisher. EV code signing certificates also have a unique identifier which makes it easier to maintain reputation across certificate renewals."
My experience is as follows. Since 2005, we have been using regular (non-EV) code signing certificates to sign .MSI, .EXE and .DLL files with timestamps, and there has never been a problem with SmartScreen until 2018, when there was just one case when it took 3 days for a beta version of our application to build trust since we have released it to beta testers. It was in the middle of the certificate validity period. I don't know what SmartScreen might not like in that specific version of our application, but there have been no SmartScreen complaints since then. Therefore, if your certificate is a non-EV, it is a signed application (such as an .MSI file) that will build trust over time, not a certificate. For example, a certificate can be issued a few months ago and used to sign many files, but for each signed file you publish, it may take a few days for SmartScreen to stop complaining about the file after publishing, as was in our case in 2018.
We didn't submit our software to Microsoft malware analysis. Microsoft started to provide this service in 2017. It may be a viable alternative to an Extended Validation (EV) certificate.
In conclusion, to avoid the warning altogether, i.e., prevent it from happening even suddenly, you need an Extended Validation (EV) code signing certificate, and/or, you can submit your software to Microsoft malware analysis.
UPDATE: Another writeup here:
How to add publisher in Installshield 2018
(might be better).
I am not too well informed about this issue, but please see if this answer to another question tells you anything useful (and let us know so I can evolve a better answer here): How to pass the Windows Defender SmartScreen Protection? That question relates to BitRock - a non-MSI installer technology, but the overall issue seems to be the same.
Extract from one of the links pointed to in my answer above: "...a certificate just isn't enough anymore to gain trust... SmartScreen is reputation based, not unlike the way StackOverflow works... SmartScreen trusts installers that don't cause problems. Windows machines send telemetry back to Redmond about installed programs and how much trouble they cause. If you get enough thumbs-up then SmartScreen stops blocking your installer automatically. This takes time and lots of installs to get sufficient thumbs. There is no way to find out how far along you got."
Honestly this is all news to me at this point, so do get back to us with any information you dig up yourself.
The actual dialog text you have marked above definitely relates to the Zone.Identifier alternate data stream with a value of 3 that is added to any file that is downloaded from the Internet (see linked answer above for more details).
I was not able to mark this question as a duplicate of the previous one, since it doesn't have an accepted answer. Let's leave both question open for now? (one question is for MSI, one is for non-MSI).
I've been selling my software Isadora (https://troikatronix.com) for 17 years, and I would like to start code signing the app and installer.
I've been turned down by three code signing certificate vendors because I'm a Sole Proprietor in Germany where the concept of DBA doesn't exist. Since there is no corporation or organization, they won't issue me a certificate.
Has anyone here succeeded in purchasing a code signing certificate as a independent developer? (Extra points if you live in Germany)
Yes, if you register yourself in Dun & Bradstreet. Your full name, physical address and phone number should be registered there and a CA can issue you a Standard Code Signing Certificate. But if you want a EV Code signing certificate, its not going to be easy.
I am also looking into this but I'm here in the US. I'm currently a sole proprietor and if you search for my DBA company name in Dunn and Bradstreet, it comes up with my personal name, not my company name. As such, Comodo wants to issue a cert with my name, not my business. They suggested I get a legal opinion letter from either an accountant or attorney, which I have yet to do. Here is the link for Comodo. Perhaps you can go through this route.
https://support.comodo.com/index.php?/Knowledgebase/Article/View/1231/0/sample-legal-opinion-letters-for-ev-certificates
I'm from Poland and recently changed from an LLC to a sole proprietorship. While buying an EV cert for an LLC is extremely easy, getting one for a sole proprietorship is extremely difficult. DigiCert told me one can obtain an EV certificate as sole proprietorship only if he/she registered under a trade name. So, if you registered under your real name, you won't be able to get an EV cert.
In 2014, I bought a class two code signing certificate from StartSSL which I used to digitally sign my binaries. This certificate has just expired and I actually am in the process of trying to get a new one. However, in an unrelated incident, I ran one of my signed setup programs in a VM and was somewhat ... annoyed ... when Windows brought up the "Unverified Publisher" variant of the UAC dialog.
When I view the digital signature properties I see this:
Of course the certificate has expired, but why is the file (that was signed within the validity period) suddenly unverified? I haven't seen this happen with other software, for example if I look at an old signed copy of Office 2003 setup, that doesn't complain about an invalid signature and that validaty period expired a decade ago.
Why is this? Frankly I'm now wondering what the the point of buying the certificate in the first place was and seriously considering cancelling the in-process replacement. Seems kind of pointless when they invalidate themselves. Or is this the different between class 2 and 3? (Class 3 is the version I'm trying to get hold of now)
This is apparently a by-design limitation on some code-signing certificates, as described in the first footnote to Microsoft's blog post, Everything you need to know about Authenticode Code Signing:
Not all publisher certificates are enabled to permit timestamping to provide indefinite lifetime. If the publisher’s signing certificate contains the lifetime signer OID (OID_KP_LIFETIME_SIGNING 1.3.6.1.4.1.311.10.3.13), the signature becomes invalid when the publisher’s signing certificate expires, even if the signature is timestamped. This is to free a Certificate Authority from the burden of maintaining Revocation lists (CRL, OCSP) in perpetuity.
You may wish to check whether the replacement certificate will have the same limitation, and perhaps consider an alternative vendor.
For my Windows-based application, I would like to use ClickOnce as the deployment technology. My application will be distributed via the Internet.
In the article ClickOnce and Authenticode, I read that:
For ClickOnce applications, you must have an Authenticode certificate
that is valid for code signing. You can obtain a certificate for code
signing in one of three ways:
Purchase one from a certificate vendor.
Receive one from a group in your organization responsible for creating
digital certificates.
Generate your own certificate with MakeCert.exe, which is included
with the Windows Software Development Kit (SDK).
In my case, number 2 is not applicable.
As I read a few rows later:
By default, ClickOnce applications signed with self-certs and deployed
over the Internet cannot utilize Trusted Application Deployment.
(Emphasis mine.)
I cannot understand the meaning of this by default. Is the option #3 possible or not in my case?
And then, to understand all the possibilities, what does the #1 imply ? ("Purchase one from a certificate vendor") What kind of certificate should I buy? Which certificate authority can be recommended? Depending on what I should choose? How much does a certificate cost?
It must be a "Microsoft Authenticode Certificate". It allows us to sign all kinds of Windows executables and code, including .exe, .cab, .dll, .ocx, and .xpi files.
It is not mandatory to sign an application, but if we do it our users won’t see a warning message stating that the author of the software is unknown.
Microsoft Authenticode Certificates need to be issued by a trusted certificate authority. Unfortunately, the prices are quite expensive. More information and some examples
are on page Microsoft Authenticode Certificates.
UPDATE I purchased the certificate through KSoftware, which is a Comodo retailer. The price is quite good compared to alternatives: $95/year. The process is faster than I expected: I applied in the morning and in the evening my certificate was already available. (For those interested, I followed this step-by-step guide.)
See my answer to Stack Overflow question How to sign a ClickOnce application.
I would definitely suggest getting a proper code-signing certificate - your application install screen will look much nicer in this case.
StartCom CA is closed since Jan. 1st, 2018 I got my code-signing certificate from http://startssl.com - and it was $100 or so in total (and you get wild-card domain certificate for your website as well as a bonus).
It's much cheaper than going with VeriSign or TrustWave.
We offer a Windows program downloadable as an InstallShield EXE from our website.
When someone running IE9 attempts to download and run our software, they see the following message at the bottom of their screen:
PROGRAMNAME.exe is not commonly downloaded and could harm your computer.
[DELETE] [ACTIONS] [VIEW DOWNLOADS]
I've read http://blogs.msdn.com/b/ie/archive/2011/03/22/smartscreen-174-application-reputation-building-reputation.aspx
It suggests:
Digitally sign your programs with an
Authenticode signature.
Ensure downloads are not detected as
malware.
Apply for a Windows Logo.
We've done all three things. Our EXE is digitally signed with an authenticode signature (and the bar above the warning message is orange, not red, indicating that IE9 recognized and verified the signature). Our download is not detected as malware by any antivirus program we've tried. And we have applied for and received a Windows Logo.
As yet, most of our customers are not using IE 9. But this is very troublesome to those who do. Is there anything else we can do about this, or do we just have to wait until a critical mass of customers have downloaded this software before this message will go away?
(Does that mean when we release a new version, all IE 9 users will get this message again until enough of them have downloaded it?)
UPDATE 2011-06-14:
Thanks, #EricLaw-MSFT. URL is http://dakim.dakiminc.netdna-cdn.com/DakimBrainFitness.exe . (It's found on the "Download Free Trial" button on http://www.dakim.com .)
We've only been offering downloadable trials for a short while. Our primary distribution method is installation DVDs.
Extended Validation Code Signing Certificates don't suffer from the need to build reputation slowly according to this post:
Reputation is generated and assigned to digital certificates as well as specific files. Digital
certificates allow data to be aggregated and assigned to a single certificate rather than many
individual programs. Although not required, programs signed by an EV code signing certificate can immediately establish reputation with SmartScreen reputation services even if no prior reputation exists for that file or publisher. EV code signing certificates also have a unique identifier
which makes it easier to maintain reputation across certificate renewals. Only Authenticode
Certificates issued by a CA that is a member of the Windows Root Certificate Program can establish
reputation.
At this time, Symantec and DigiCert are offering EV code signing certificates.
In an effort to improve my answer, I've added a link to a similar question I asked and eventually answered myself.