Results 11 to 15 of 15

Thread: SetupBuilder and Code-Signing

Threaded View

Previous Post Previous Post   Next Post Next Post
  1. #1
    Join Date
    Mar 2004
    Posts
    3,867

    Default SetupBuilder and Code-Signing

    Please read the following SetupBuilder Code-Signing Guide:

    http://www.lindersoft.com/CodeSign.pdf

    Table of Contents
    Part I Introduction
    Part II FAQ
    Part III Buying A Certificate - The Lindersoft "Deal"
    Part IV Getting the Tools
    Part V Setting Up SetupBuilder
    Part VI Code-Signing Your Installer
    Part VII Code-Signing Your Application Files

    Note: CAPICOM.dll has been removed from the Microsoft Windows SDK for Windows 7 and .NET Framework 3.5 SP1.


    Q3 2014 Updates:

    http://www.lindersoft.com/Comodo2014.pdf

    As of late August 2013, all valid (not expired, not revoked) Comodo Code Signing Certificates can be used for Kernel-Mode Code Signing (Windows Vista and greater).

    Microsoft has published a security advisory on "Deprecation of SHA-1 Hashing Algorithm for Microsoft Root Certificate Program". The new policy takes effect after January 1, 2016 and requires CAs to migrate to the stronger SHA-2 hashing algorithm.

    In summary, Windows will cease accepting SHA-1 certificates on January 1, 2017. To continue to work with Microsoft platforms, all SHA-1 SSL certificates issued before or after this announcement must be replaced with a SHA-256 (SHA-2) equivalent by January 1, 2017. Organizations need to develop a migration plan for any SHA-1 end-entity SSL certificates that expire after January 1, 2017 and SHA-1 code signing certificates that expire after January 1, 2016. SHA1 code signing certificates that are time stamped before 1 January 2016 will be accepted until such time when Microsoft decides SHA1 is vulnerable to pre-image attack. Microsoft will give new consideration to the SHA deprecation deadlines in July 2015.

    1. Customers should "renew" with SHA-2 end-entity and intermediate certificates.

    2. Microsoft will cease trusting Code Signing Certificates using SHA-1 on January 1, 2016.

    Most applications, servers and browsers now support SHA-2, however some older operating systems such as Windows XP prior to Service Pack 3, and some mobile devices do not.

    For example: http://support.microsoft.com/kb/2763674

    Before the SHA-1 algorithm is formally deprecated by Microsoft, it is important to ensure your organization and those relying on your infrastructure are benefiting from SHA-2 support by installing the latest version of the application or browser and applying all known security updates to your operating system.

    Comodo will support only SHA-2 on all 3 year code signing certificates. They will also confirm policies at this time regarding 2 year SHA-1 code signing certificates.

    http://www.comodo.com/e-commerce/SHA-2-transition.php

    --
    Friedrich Linder
    Lindersoft
    www.lindersoft.com
    +1.954.252.3910

    --Helping You Build Better Installations
    --SetupBuilder "point. click. ship"
    --Create Windows 8 ready installations in minutes
    --Official COMODO Code Signing and SSL Certificate Partner
    Attached Images Attached Images  
    Last edited by linder; 06-05-2014 at 05:27 AM.

Thread Information

Users Browsing this Thread

There are currently 2 users browsing this thread. (0 members and 2 guests)

Tags for this Thread

Posting Permissions

  • You may post new threads
  • You may post replies
  • You may not post attachments
  • You may not edit your posts
  •