Challenges and Solutions for Digitally Signing Installers in Cloud-Based Environments

What is a Code Signing Certificate?

A code signing certificate is a digital certificate used to sign software programs and installers. It verifies the identity of the software publisher and ensures the installer has not been altered since it was signed. This enhances the security of software distribution and builds trust with users.

Types of Signing Certificates

There are several types of certificates, each with specific uses and level of validation. Here are the primary types:

• Standard Code Signing Certificates: Provide basic validation of the publisher. These certificates are suitable for general software distribution needs. They can be easily obtained and are trusted by most operating systems.
• Extended Validation (EV) Code Signing Certificates: Offer a higher level of security and involve a rigorous verification process of the organization. Software signed with EV certificates enhances user trust and has a higher reputation, making it a good option for added security.

Transitioning to Cloud-Based Code Signing Solutions

Developers have commonly adopted local storage for their certificates to sign installers because it has been a simple and effective method.

However, this storage method poses risks if not handled properly, such as weak passwords, unauthorized access, or improper handling.

That’s why the industry has moved towards more robust cloud-based solutions for improved security, which also meet the new storage criteria like using hardware certified as FIPS 140-2 level 2 to store certificates.

This shift is driven by the adoption of cloud-based services and continuous integration/continuous deployment (CI/CD) pipelines.

Traditional methods of handling digital certificates become less practical, especially because cloud-based virtual machines (VMs) often lack access to local certificates stores. Cloud-based code signing solutions address these challenges by providing efficient ways to manage and apply digital signatures in many development workflows.

How a Cloud-Based Signing Architecture Works

A cloud-based signing system is composed of several components:

1. Client Side: Represented by signing tools used by developers to orchestrate the signing of binaries. When signing is triggered, the pipeline sends a request to the signing server specifying the artifacts to be signed. The role-based access control mechanism ensures that only authorised users can initiate the signing process.
2. Signing Server: Receives the signing requests and retrieves the appropriate signing keys from the Key Management Service (KMS). The digital signature is generated and the artifacts are securely signed on the signing server. Most vendors send only the hash of the data being signed to the signing server, not the full files. The server sends back the signed metadata to be injected into the binaries.
3. Key Management Service (KMS): Manages the signing keys and provides them to the signing server as needed.
4. Dashboard for Administrators: Used to monitor singing activities, manage keys and review audit logs. Administrators are informed of any issues or security concerns through alerts and notifications.

Cloud-Based Code Signing Benefits and Challenges

Cloud services for code signing offer several advantages that improve the efficiency of software releases:

• Enhanced Security: The signing keys are stored in secure environments, reducing the risk of compromise.
• Global Availability: Users can access the certificates remotely to sign software, which is ideal for distributed teams and remote work environments.
• Centralized Management: Users can have better control of the singing process through a centralized dashboard.
• Seamless Integration: Cloud code signing solutions can easily integrate into many existing development platforms and tools.

Despite the numerous benefits, cloud services also present several challenges that you need to be aware of:

• Network Dependence: Cloud-based services rely on network connectivity. Any network downtime or latency can delay the signing process.
• Learning Curve: Development teams switching to cloud-based solutions may face a learning curve, requiring modifications to existing workflows and possibly adapting to new tools.
• Cost Management: Moving from an on-premise solution to a cloud-based code signing solution requires a cost-benefit analysis to evaluate long-term costs.

Cloud-Based Code Signing Options

There are many third-party cloud-based options that offer code signing capabilities for installers. Here are two of them:

• DigiCert Secure Software Manager is a cloud-based platform from DigiCert that allows developers to issue and manage certificates across multiple environments. This service securely handles certificates and signing processes in the cloud, eliminating the need for a local certificate. You can use the platform to issue a certificate directly to your development environment and configure your pipeline to sign your desktop installer.
• SSL.com Code Signing as a Service provides a cloud based platform designed for code signing. It supports integration with multiple CI/CD platforms and ensures a secure and efficient signing process, which makes it a good option to sign desktop installers. You can issue certificates directly from SSL.com’s platform, connect your pipeline and automate the signing process through the service’s API.

Secure Signing Practices

There are some guidelines developers need to follow for secure signing both on local and cloud environments.

One important aspect is protecting the private keys. Use strong passwords and encryption, and rotate the keys to reduce the risk of compromise.

For local environments, use the Windows Certificate Store to manage your certificates.

For cloud environments, use the secure storage solutions provided by your platform. Cloud solutions offer several additional benefits over local setups like centralized management, enhanced scalability, automated renewal and revocation, and security measures such as HSMs.

For high-level security, implement access controls in your CI/CD pipeline and monitor the code singing activities to detect potential security incidents. Some cloud signing services offer audit logs to track the history of signed files, providing valuable information such as the identities of signers, date and time of signing, and actions taken on the document.

Cost-Effective Solutions

Finding a cost-effective solution for signing installers is important, especially for small to medium-sized development teams. A good option should balance security, ease of use and cost.

Here are some options:

Conclusion

Digitally signing installers is crucial to maintaining the security and integrity of software applications. Developers should explore modern, cloud-based solutions and implement best practices for secure signing. Selecting the right tool is a balance between security, scalability and cost-effectiveness.