Code Signing Certificate

A code signing certificate is a digital certificate that binds a developer or company identity to a key pair used to sign executables, installers, drivers and scripts. The signature lets an operating system check who published the file and that it has not changed since signing.

Why it matters

Platforms such as Windows and macOS warn users, or block installs, for unsigned or untrusted software. A valid signature carries publisher identity into those prompts. Code signing certificates are separate from the TLS certificates that protect websites: they are issued under different rules, and a website certificate cannot sign software. Because anyone holding the private key can publish software as you, current industry rules require keys to be kept in protected hardware or equivalent secure storage rather than a plain file on a build server.

Example

A release pipeline signs an installer and attaches a trusted timestamp:

signtool sign /fd SHA256 /tr http://timestamp.example.com /td SHA256 app.exe

The timestamp proves the signature was made while the certificate was valid, so the file still verifies after the certificate expires.

Common mistakes

• Skipping the timestamp, so every signature breaks on the certificate's expiry date.
• Storing the signing key in a shared repository or CI variable that many people can read.
• Assuming a signed file is safe. A signature identifies the publisher, not intent.

Related

• Certificate authority
• Private key
• Hardware security module
• Hashing

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.