For Windows software developing companies, it is a good practice to have their EXE/DLL/SYS files signed with a code-signing cerfiticate. For example, Google Chrome executables have digital signatures.

Google Chrome executables have digital signatures

But, I think it is a bad practice to have each developer install a copy of code-signing certificate(CSC) in their development machines, because CSC's private key should not be directly accessible to each developer, right? That private key should be known to only one Administrator so only this Administrator is responsible for keeping that key secret.

So, I think there should be a code-signing server set-up by the Administrator, and individual developers should upload their executables to the server to receive actually code-signing. Of course, the server keeps a log of which file is signed by which developer. In case there is a violation of the corporate rule(e.g. a bad guy signs a malware with corporate's CSC), we can trace back to find out the bad guy.

Does such a server software exist in the market? If not, how do those many software companies cope with such a requirement?

  • I think it's a great idea for people to upload executables to get them signed. Instead, just use any CI server that fires a compilation on each commit (or at some specific time, or so on), gets the whole code from source control, does the compilation itself and after that signs the binaries, which then are published to a network share. The key remains on the server and the signed binaries come only from trusted code. Deliverate malicious actions are caught on the source control history and can be reverted. – Alejandro Apr 4 '18 at 17:33

You are correct in your concerns, as giving all employees access to your signing certificate can be almost as dangerous as publishing it on the Internet.

We use GitLab's Continuous Integration (CI) to accomplish this task. When code is committed to the repository, a CI script compiles it and runs several unit tests. The compilation and testing is not executed on the developer's machine, but rather on several runners that have been built for this purpose.

Runners have many advantages, but in your context, the runners can be completely isolated from the development environment.

Back when we were first exploring this, I had found a good Q/A about this technique on (I think) serverfault, but I cannot find it now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.