Signing Code with Microsoft CA certificates

Signing Code with Microsoft CA certificates

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Signing Code with Microsoft CA certificates Broonie 12-29-2006
Posted by Broonie on December 29, 2006, 10:06 am
If you were  Registered and logged in, you could reply and use other advanced thread options
I have a Windows 2003 stand-alone certifcate server running and working
fine. I use it mostly for web browser certificates but now I want to
use it to sign .jar files. I see there is an advanced option when
creating a certificate request in the "Type of Certificate Needed"
section to choose "Code Signing Certificate". I've requested and
retrieved it but that's about it. How do I now go about signing my .jar
files?

Cheers

Craig


Posted by =?Utf-8?B?SmVzcGVy?= on December 29, 2006, 1:06 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Your development environment should have some feature like that. Microsoft's
tools are very much geared toward signing code written in Microsoft's
development environment. If you search for "sign code" on MSDN you will find
a lot about it:
http://search.msdn.microsoft.com/search/default.aspx?siteId=0&tab=0&query=sign+code.
The results include tools to sign code with that may work for you.

"Broonie" wrote:

> I have a Windows 2003 stand-alone certifcate server running and working
> fine. I use it mostly for web browser certificates but now I want to
> use it to sign .jar files. I see there is an advanced option when
> creating a certificate request in the "Type of Certificate Needed"
> section to choose "Code Signing Certificate". I've requested and
> retrieved it but that's about it. How do I now go about signing my .jar
> files?
>
> Cheers
>
> Craig
>
>

Posted by Broonie on January 8, 2007, 5:28 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Jesper,

All the stuff in MSDN seems to state that Authenticode will only allow
signing of EXEs, OCXs, CABs and DLLs. Is this the case? If so how do I
go about signing .jar files?

Cheers

Craig

Jesper wrote:
> Your development environment should have some feature like that. Microsoft's
> tools are very much geared toward signing code written in Microsoft's
> development environment. If you search for "sign code" on MSDN you will find
> a lot about it:
>
http://search.msdn.microsoft.com/search/default.aspx?siteId=0&tab=0&query=sign+code.
The results include tools to sign code with that may work for you.

>
> "Broonie" wrote:
>
> > I have a Windows 2003 stand-alone certifcate server running and working
> > fine. I use it mostly for web browser certificates but now I want to
> > use it to sign .jar files. I see there is an advanced option when
> > creating a certificate request in the "Type of Certificate Needed"
> > section to choose "Code Signing Certificate". I've requested and
> > retrieved it but that's about it. How do I now go about signing my .jar
> > files?
> >
> > Cheers
> >
> > Craig
> >
> >


Posted by =?Utf-8?B?SmVzcGVy?= on January 8, 2007, 11:46 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Like I said, but apparently not very clearly, Authenticode is a Microsoft
technology, designed to be used with code that runs natively on the Microsoft
platform. Microsoft does not provide tools to develop in Java. If you want to
sign JAR files you need to look at your Java environment and see if it lets
you do it.. There is nothing on the Microsoft platform to run JAR files, and
hence, nothing to validate the signature. That would have to be done by the
Java Runtime you are writing for.

Your other option is to package your JAR file in a CAB and sign that, but I
don't see what that will do for you.

If you really want to make use of Authenticode, write in C# instead.

"Broonie" wrote:

> Jesper,
>
> All the stuff in MSDN seems to state that Authenticode will only allow
> signing of EXEs, OCXs, CABs and DLLs. Is this the case? If so how do I
> go about signing .jar files?
>
> Cheers
>
> Craig
>
> Jesper wrote:
> > Your development environment should have some feature like that. Microsoft's
> > tools are very much geared toward signing code written in Microsoft's
> > development environment. If you search for "sign code" on MSDN you will find
> > a lot about it:
> >
http://search.msdn.microsoft.com/search/default.aspx?siteId=0&tab=0&query=sign+code.
The results include tools to sign code with that may work for you.

> >
> > "Broonie" wrote:
> >
> > > I have a Windows 2003 stand-alone certifcate server running and working
> > > fine. I use it mostly for web browser certificates but now I want to
> > > use it to sign .jar files. I see there is an advanced option when
> > > creating a certificate request in the "Type of Certificate Needed"
> > > section to choose "Code Signing Certificate". I've requested and
> > > retrieved it but that's about it. How do I now go about signing my .jar
> > > files?
> > >
> > > Cheers
> > >
> > > Craig
> > >
> > >
>
>

Similar ThreadsPosted
Code signing a "Flash" .EXE file issue / Code sign any .EXE? March 6, 2008, 6:48 am
Code Signing - Deciding between Thawte and VeriSign August 16, 2005, 11:13 am
Expired Code Signing Cert with VBScript September 12, 2006, 9:17 am
Issuing Code-signing Certificate with Private Key December 27, 2007, 11:41 am
Issue with enterprise internal Authenticode code signing certificate More options April 3, 2007, 8:41 am
Does Microsoft Need a New Source Code for the Future? July 24, 2008, 9:09 pm
Microsoft Executive Circle Webcast: Security360 with Mike Nash: Building a Secure, Connected Infrastructure with Digital Certificates April 18, 2006, 7:25 am
Microsoft IIS ASP Remote Code Execution Vulnerability July 18, 2006, 10:04 pm
Microsoft PowerPoint Code Execution Vulnerability October 2, 2006, 6:42 pm
Microsoft rejects product code as incorrect when it is CORRECT. W March 19, 2007, 7:23 pm

The site map in XML format XML site map

Contact Us | Privacy Policy