Welcome to our community!

OnPrem Signing Certificate

Avatar
Andrew Aldridge
  • updated
  • Open

I'm trying to start a thread for us to discuss the latest bombshell that we have 6 days to provide our own code signing certificates, my previous attempt is "Awaiting Moderation" which may just be because I included a URL in the post?

While it feels very much like a final attempt to kill off the on-prem user base, there's no real benefit discussing that other than venting so I'm looking to see if anyone's research so far as turned up an affordable way of acquiring code signing certificates.

The likes of DigiCert, SSL etc seem to come out at several hundred $/year in the first year, possibly dropping from there once you own a suitable storage method for the certificate.

Azure Trusted Signing looked promising for a while at a few $ a month - but is currently only available to USA and Canada based businesses, so rules out the rest of us.

Does anyone have any other sources?

Thanks
Andrew

Replies 83
Avatar
6
MTHT

Outside of the extra cost for the Code Signing Certificates and the hurdles to acquire one and use it. I would like to know how they except a organization to sign their code? Are they planning to open source the code base or release it under an some type of NDA so that I can provide my auditors the code that we are now signing?

Avatar
5
Andrew Aldridge
Quote from Martin Plank

I see also the problem with the private key - I don't know how this should work?

"The new CA/B Forum rules require all Code Signing Certificates be provisioned and shipped on hardware-based tokens."

As far as I know this is not possible with ConnectWise Control?
Maybe they have changed something? We will see ..

Regards,

Martin

Yes others are saying it needs something like a "Yubikey 5C Nano FIPS" but how one passes that through to a VPS running ScreenConnect server is a mystery to me at the moment.

It seems ... unfortunate ... that SC didn't publish their guidance on obtaining and applying certificates at the same time as this announcement.

Why was it not an option to just remove the customisation and continue to sign with their certificate? If they can do it on their hosted solution why isn't it valid for on-prem? Edit: I realise they'd need to bake in our relay URL, but that's not beyond the wit of man surely?

Avatar
2
Martin Plank

I see also the problem with the private key - I don't know how this should work?

"The new CA/B Forum rules require all Code Signing Certificates be provisioned and shipped on hardware-based tokens."

As far as I know this is not possible with ConnectWise Control?
Maybe they have changed something? We will see ..

Regards,

Martin


Customer support portal powered by UserEcho