Category: Issue Certificates
Complexity: * (Medium-High)
Prerequisites: CSR available, Code-Signing CA
Estimated Time: 10-15 minutes </WRAP> —- ===== Description ===== This scenario describes issuing a code-signing certificate for signing software. Code signing enables verification of the origin and integrity of executables, DLLs, scripts, and packages. Use cases: * Windows Authenticode (EXE, DLL, MSI) * PowerShell scripts * Java JAR files * NuGet packages * macOS code signing * Firmware signing —- ===== Code Example (C#) ===== <code csharp> using WvdS.Security.Cryptography.X509Certificates.Extensions.PQ; using var ctx = PqCryptoContext.Initialize(); var caCert = ctx.LoadCertificate(„codesign-ca.crt.pem“); var caKey = ctx.LoadPrivateKey(„codesign-ca.key.pem“, „CaPassword!“); var csr = ctx.LoadCertificateRequest(File.ReadAllText(„codesign.csr.pem“)); csr.VerifySignature(); Issue code-signing certificate var codesignCert = ctx.IssueCertificate( csr, issuerCert: caCert, issuerKey: caKey, serialNumber: ctx.GenerateSerialNumber(), validDays: 730, 2 years extensions: new ExtBuilder() .BasicConstraints(ca: false, critical: true) Key Usage: Only digitalSignature! .KeyUsage(KeyUsageFlags.DigitalSignature, critical: true) Extended Key Usage: Code Signing .ExtendedKeyUsage(ExtKeyUsage.CodeSigning) .SubjectKeyIdentifier(csr.PublicKey) .AuthorityKeyIdentifier(caCert) Timestamping URL for long-term validation .AuthorityInfoAccess( ocspUrl: „http://ocsp.example.com“, timestampUrl: „http://timestamp.example.com“ ) .Build() ); codesignCert.ToPemFile(„codesign.crt.pem“); </code> —- ===== Extended Key Usage Variants ===== ^ OID ^ Name ^ Usage ^ | 1.3.6.1.5.5.7.3.3 | codeSigning | Standard code signing | | 1.3.6.1.4.1.311.10.3.13 | lifetimeSigning | Windows Kernel-Mode | | 1.2.840.113549.1.9.16.1.4 | firmwareSigning | Firmware (optional) | —- ===== Industry-Specific Requirements ===== ^ Industry ^ Requirement ^ Specifics ^ | Automotive | UN R156 | Firmware updates, Secure Boot | | Healthcare | DiGAV | Medical device software | | Industry 4.0 | IEC 62443 | PLC firmware | | Standard | Microsoft Authenticode | Windows SmartScreen | —- ===== Windows Authenticode Signing ===== <code powershell> # With SignTool and PQ certificate signtool sign /fd SHA256 /f codesign.pfx /p „Password“ /tr http://timestamp.example.com /td SHA256 myapp.exe # Verify signature signtool verify /pa /v myapp.exe </code> —- ===== Timestamp Servers =====