Sectigo will issue a code signing certificate onto hardware you already own, but only if you can prove the private key was born inside that hardware and cannot leave it. On a Thales Luna Network HSM the proof is a public key confirmation, or PKC: a certificate chain the HSM itself signs, attesting that a […]
Enrollment is the part of an EV code signing order that most guides stop at. The part that actually blocks people comes after: a sealed package arrives from a courier, it contains a USB token and a letter, and nothing on your machine can see either of them yet. This guide covers that stretch, from […]
Buying a code signing certificate involves one option that behaves differently from every other field on the order form. Long before validation starts, you have to say where the private key is going to live: on a hardware token the Certificate Authority builds and mails to you, or on hardware you already own and operate. […]
You have paid for a code signing certificate and nothing has arrived. The order sits at “pending validation”, the Certificate Authority has emailed you asking for something, and it is not obvious what would actually close the request. That is the normal state of a code signing order, because code signing is validated against your […]
You have ordered a Sectigo code signing certificate and nothing has arrived. That is normal: the certificate does not exist yet. Sectigo has to establish who you are before it will sign anything with your name in it, and that vetting is the slowest part of the purchase by a wide margin. This guide covers […]
A code signing certificate is not installed the way an SSL certificate is. There is no file to drop onto a server. The private key has to be created inside a piece of certified hardware and stay there for the certificate’s whole life, which changes the order of every step that follows: what you choose […]
This guide explains how a Certificate Signing Request (CSR) is generated for a code signing certificate when you work with OpenSSL, and, just as important, when that approach no longer applies. Since June 1, 2023, the rules for code signing keys changed, so the old software-only OpenSSL workflow is not accepted by Certificate Authorities for […]
The Certificates snap-in in Microsoft Management Console (MMC) can build a PKCS #10 certificate request on a Windows machine without any extra software. This guide covers that wizard screen by screen for a code signing certificate, and it starts with the part most older instructions leave out: the rules for code signing private keys changed […]
The Windows certreq.exe utility builds a Certificate Signing Request (CSR) from a plain-text policy file, normally called request.inf. It is the scriptable way to create a request on Windows without clicking through the Certificates snap-in. This guide shows the policy file and the commands, and it starts with the rule that decides whether a certreq […]
Keychain Access is still on every Mac, and its Certificate Assistant still generates certificate signing requests. Whether that request is any use for code signing depends entirely on which certificate you are ordering. For an Apple Developer ID certificate, the one that lets you distribute Mac software outside the Mac App Store, Keychain Access is […]
