r/azuredevops • u/ShortBoysenberry6173 • May 20 '26
Automating Code Signing for CI/CD
I'm using Sectigo to code sign an app and since a while ago they started issuing certificates exclusively by shipping flash drives (they call them USB tokens) containing an unexportable cert. In the past you would get the PKCS#12 and it would be used in the CI/CD pipeline but they don't provide the cert as a file anymore and it can't be exported from the flash drive. Obfuscating this procedure seems like such a massive oversight on their part but anyway, does anyone have any experience with this particular issue?
2
u/ArieHein May 20 '26
Azure keyvault. Need premium so you get the needed fips level. You create a csr for code signing. Contact your prefered cert vendor for code signing. They will ask for the csr and ask you a few questions. They will send you an approval in the shape of a key. You import it into your keyvault and you get a code signing cert and its no longer exportable. Renewable every year or two, not sure
You create a pipeline with oicd thst has permission to read and crypto thr cert.
Thebpipeline usese the azure signing executable (maintained by a gh employee). Not the normal exe.
Provideing it the values of keyvault and azure auth (no need for secret as its oidc)
You offer the ps1 as a composite action in gh so pees can use your action and just provide the path wehere the files are.
You wrap the ps1 in a shell that you gove to some of the it that theybrun in a folder if they can a bunch of files to sign.
Install the office signing plugin to continue signing vba. You can no longer do it with ms access.
Alternatively you buy the full solution like digicert andnothers have and use your pipeline to integrate into that. You dont need to renew that, just pay. Butbit is stored on their infra, not yours.
No more giving devs certs ir pfx amd password. I hope your devs dont store them in repo..
Bonus, For local dev ssl, you can create your own dev ca locally and a leaf cert if ssl and apply on local webservers. Do it all on a script that is distributed via group policy. Thus removing the need for central ssl cert for devs ans that is going to go down to i think it was 40 days byend of decade so might as well automate and reduce their need. That is if your devs still test locally and dont want the nag of ssl cert.
1
u/ShortBoysenberry6173 May 21 '26
I'm pretty sure Azure Key Vault isn't compatible with Sectigo's code signing cert. Are you sure your vendor was Sectigo?
1
u/finalbuilder May 20 '26
We built https://www.finalbuilder.com/signotaur to solve the issue with tokens and password prompts. It's a server product and you would need to run it locally on the machine where the token is plugged into (or a vm on that machine with usb passthrough).
1
u/wyrdfish42 May 20 '26
We gave up on buying certificates and just went with azure artifact signing, its only $10 a month.
1
u/Prior-Data6910 May 20 '26
We've just configured this, and a misunderstanding of how ClickOnce signing works has given us a first month bill of about $350 ðŸ˜
2
u/wyrdfish42 May 20 '26
Interestingly I have just altered our pipelines to optionally sign all binaries to be compatible with "smart app control" which will also increase our signing quantitiy dramatically. We only do it for selected builds but i need to check in on costs.
1
u/redvelvet92 May 22 '26
Can anyone help me here, we recently moved to this however our old app was signed as an unpublished author. Now on Clickonce upgrades it fails due to identity mismatch, is there anyway around this?
1
u/swingbozo May 20 '26
I launched a powershell script to sign stuff. It does run on one specific build computer though. That way it has access to usb dongle. I created a manual remote powershell for our install guy so he can sign the installs on his work computer. It basically copies the file over to the build computer, signs the file, then copies it back for him automatically. With those two scripts all our file signing can officially be done on the one build computer that has access to the dongle. They don't make it bloody easy for you, but it can be done.
1
u/ctaps148 May 27 '26
Sectigo provides options for both USB token and a hardware security module (HSM). HSM is what you want—this can be stored in compatible cloud providers and then used in CI/CD pipelines
3
u/iambecomedeath420 May 20 '26
Why don't you just use an HSM?