Code Signing
Choose a certificate, prepare validation documents, sign your releases, and troubleshoot signatures.
27 articles in this category
SimplySign Desktop: Set Up Certum Code Signing in 5 Steps
SimplySign Desktop connects your computer to a Certum code signing certificate whose key stays on a virtual card in Certum's cloud. The five setup steps from activation to a signed EXE, the systems and builds Certum supports as of October 2026, the SignTool command option by option, and the limits to plan around: 5,000 signatures a month and a new thumbprint at every reissue.
Can You Sign a Docker Image With a Code Signing Certificate?
Notation signs OCI container images with an X.509 code signing certificate, and a publicly trusted OV or EV certificate meets its requirements — but it ships with an empty trust store, so the public trust you paid for does not travel. Docker's 8 December 2026 shutdown of Notary v1, the certificate rules in the signature specification, why the hardware key mandate rules out the local-key path, the 460-day validity collision that breaks untimestamped signatures, and when buying a public certificate for containers is actually worth it.
How to Sign RPM and DEB Packages (and Why a Code Signing Certificate Won't)
Linux packages are signed with an OpenPGP key, and as of September 2026 there is still no way to sign an RPM directly with a certificate from a public CA. The rpmsign setup and how to read its output, why dpkg ships with embedded .deb signature checking switched off, the InRelease hash chain that is the signature apt actually verifies, the signed-by keyring pattern that replaces apt-key, what RPM 6.0 changed on 22 September 2025, and the key custody decision nobody makes for you.
NuGet Trusted Signers: Fixing NU3034 After a Certificate Rotation
NU3034 is not a broken package — it is a fingerprint allow list meeting a certificate it has never seen. What changed when Microsoft moved to a new NuGet author-signing certificate on 23 September 2026, why the fix is to append the new fingerprint rather than replace the old three, how deleting the trustedSigners section turns the error green by turning the check off, why author trust has no sync command when repository trust does, and what the 460-day validity ceiling means once people pin your packages.
Why Malware Gets Signed With Valid Certificates
A code signature makes two claims — a verified identity signed this file, and the bytes have not changed — and never claims the code is safe. The four routes attackers use to obtain one, why the June 2023 hardware mandate closed only the first, what Microsoft's May 2026 takedown of a malware-signing service revealed about deliberately short-lived certificates, and how revocation dates and timestamps decide which signatures survive.
Code Signing Key Attestation: Using Your Own HSM
A CSR proves you hold a private key; it says nothing about where that key lives — and since June 2023 that is the only thing the code signing rules care about. What key attestation is, the seven verification methods in CSBR section 6.2.7.4.2 and which CAs support which, whether a YubiKey or a Luna HSM qualifies, the auditor-witnessed route for hardware that cannot attest, and why a 460-day certificate renews just outside the 13-month reuse window.
FIPS 140-2 Is Historical: What It Means for Code Signing
On 21 September 2026 every remaining FIPS 140-2 validation moved to NIST's Historical list, and a week of vendor emails made it sound like an expiry. What Historical actually means next to Active and Revoked, why the Code Signing Baseline Requirements' “FIPS 140-2 Level 2 or Common Criteria EAL 4+” sentence did not change, the one clause the CA/Browser Forum has updated to name FIPS 140-3 and the two it has not, what to ask a token vendor now, and the single case where somebody genuinely has to buy new hardware.
Android Code Signing: Why There Is No Certificate to Buy, and What Developer Verification Changes
There is no Android code signing certificate for sale, and the reason is arithmetic rather than policy: Google Play requires the signing certificate to stay valid past October 22, 2033, while the CA/Browser Forum has capped publicly trusted code signing certificates at 460 days since March 1, 2026. Why Android pins your self-signed key at first install instead of asking a CA who you are, who really holds the key once Play App Signing is switched on, why rotating a compromised key adds one rather than retiring it, and what the developer verification deadline of September 30, 2026 actually asks you to register.
Code Signing Certificates for Individual Developers
An individual with no limited company can buy a code signing certificate — two of the three tiers are issued to natural persons. Open Source and Individual Validation are open to you; Extended Validation is not, unless a sole proprietorship is registered, because a registered sole trader counts as a Business Entity while a private person does not. The trade-off nobody mentions until the first installer ships is the name: on the Individual Validation route your own legal name becomes the publisher users read, and SmartScreen reputation banks against it rather than transferring if you incorporate later.
How to Sign a Python EXE Built with PyInstaller
PyInstaller signs nothing for you on Windows, and almost every Python signing tutorial still tells you to point SignTool at a PFX file that no CA has been allowed to issue since June 2023. What a signature on a onefile build really covers, why the runtime it unpacks into %TEMP% can never be signed, which build mode that decision should change, where the two signing steps belong in a release pipeline, and what the 460-day validity cap does to a script missing one flag.
Sharing One Code Signing Certificate Across a Team
Since 1 June 2023 the private key is generated inside certified hardware and cannot be exported, so there is no file left to copy onto a second laptop. What a team shares now is access to one key, and only one of the four arrangements teams use lets two developers sign at the same moment. Why the obvious fix — a certificate per developer — quietly splits your Windows SmartScreen reputation, and what the 460-day limit does to that arithmetic over five years.
How to Code Sign an Electron App (Windows and macOS)
An Electron app needs two unrelated certificates, and the PFX file every older tutorial shows can no longer be issued. The three ways electron-builder reaches a hardware-held key, the session limit that decides whether a hosted CI runner can sign at all, and the macOS steps that have nothing to do with your Windows certificate.