Do you support Code sign certificates?

Right now we are planning to issue certificates only for TLS server authentication, and not for any other purpose. Code-signing certificates as they’re used today are part of systems that try to decide whether a software source is malicious or legitimate. I don’t think Let’s Encrypt could easily pl…

[image] schoen: like iurewnrjewknkjqoiw.biz, Is there a hidden message in this domain name? :grin:

In the future, could it be considered to add an exception to this, by allowing acknowledged open-source software to benefit from code signing certificates? There are several CA which have such programs.

@don-vip , this might not be a good fit for Let’s Encrypt because we’re focusing on certificates that can be issued in a completely automated way (which DV certificates for TLS servers can be). That allows us to issue certificates free-of-charge on a large scale. It seems to me that people expect cod…

[image] schoen: the outside world Yes, the "outside world". :grin:

FWIW, I would argue that a domain-validated code signing certificate definitely has some value. Since software is usually distributed as download anyway nowadays, associating the author with domain seems quite natural. For example, if I download the latest Firefox and the binary is signed by whoever…

I completely agree. Just an example: When I install FileZilla, Windows tells me it is signed by “Tim Kosse”. How does the average user know that “Tim Kosse” is the legitimate author of FileZilla? I cannot even find an impress on the Filezilla website to check the name. Wikipedia knows, but how trus…

hi @crazy4chrissi there are a couple of other challenges with code signing certificates A) Only certain languages support code signing and verification B) Other ways to protect users against code: PGP signatures but once again this relies on you trusting PGP code MD5 hasshums - this relies on yo…

[image] ahaw021: I believe the next iteration of this will be blockchains which will allow a consensus and a public record of code and their signatures. Validation of publishing houses/open source projects can then be potentially centralised which will bring more trust. There is a mechanism …

Do you support Code Signing

Server

schoen August 21, 2015, 5:22pm 4

Nope! Just an example of a domain name that someone could easily get with minimal investment.

Topic		Replies	Views
PKCS #12 certificates to be used with MassCert	10	4700	March 29, 2016
Code Signing Certificate for Free Microsoft Apps Help	3	35321	February 26, 2021
Code signing certificates Feature Requests	5	16190	December 14, 2018
Software Publisher Certificates / Code Signing Certificates Help	1	788	April 6, 2020
Is there any truth to this article?	4	2150	January 29, 2016

Do you support Code Signing

Related topics