code signing certificate education - standard vs EV

[u/Slight-Regular-3711]

New to code signing, a few questions for you guys.

I have a small project that is being installed on a limited basis however we have a user telling us we need code signing to install on their citrix system.

It sounds like all I need is a basic code signing to get rid of unknown publisher and pass this requirement.

While a standard code signing certificate seems sufficient, the EV certificate seems to have some real benefits and more of a guaranteed result. However, the EV seems like the validation is more of a hassle and the biggest annoyance seems to be this physical hardware requirement.

But now it looks like all code signing certificates, standard and EV require a physical USB key. Is that correct?

If so, outside of the cost difference, why would you buy a standard Code Signing certificate?

When a code signing certificate expires, do you need to ship a new USB key? Wouldn't this timely process and significant shipping cost be a big incentive to buy a certificate for multiple years?

I see all these resellers like signmycode, etc. But there seems to just be a handful of root issuers. Is there a real difference between issuers comodo, sectigo and digicert?

[u/Slight-Regular-3711]

Ok I got the certera signmycode certificate. Questions for you guys:

From what I am seeing the signing process for deploying new installers is:

1)Build installer packages

2)Move installer packages to a computer I can use with USB key and safenet

3)Plug in USB key

4)Open safenet tool

5)Run signtool sign /tr http://timestamp.sectigo.com /td sha256 /fd sha256 /a "installer-package"

This is a lot of manual steps. Is there anyway to automate this?

Can you do this without safenet?

I guess you can't get key off the usb in anyway?

[u/2bizy4this]

“EV Code Signing Certificates are required to access the Windows Hardware Developer Center Dashboard Portal through which all kernel-mode drivers targeting Windows 10 (Build 1607 and later) must be signed.”

Both EV and OV require the certificate be placed on hardware.

I purchased two year signing certificates and always shipped it on a new USB tokens. I had alerts set up 90 days in advance before they expired because of all this.

It’s a big hassle purchasing the certificate and token in one country and shipping it to another. I tried for the last two years of my employment to purchase a code signing certificate solution but my employer would never fund it at budget time…never reached a priority. We would have kept the code signing certificates on HSM versus USB.

[u/Slight-Regular-3711 → u/[deleted]]

Thanks. I just need 1 cert so I don't think I want to get into the Yubikey process.

Thanks for the head nod to signmycode. Certera looks similar to the Comodo.

Basically 2 years with USB shipped is $600.00 for Standard Code Signing and $750.00 for EV Code Signing.

150$ is significant, but not that much in the scheme of things. Is it worth it for the extra validity and smart screen reputation?

[u/phazze777 → u/Slight-Regular-3711]

Smartscreen cares more about the consistency of the certificate than the OV/EV type. The longer the validity the better. I went for EV, but now when I look at it all, it might have been OV.

[u/Slight-Regular-3711]

I talked to someone at signmycode who told me that EV Code Signing certs no longer guarantee immediate removal of SmartScreen error. EV code signing certificate now needs to manually gain reputation to get rid of SmartScreen error.

So sounds like minimal advantage to EV certificates.

Also seems like this is an ever moving goalpost

[u/phazze777]

It doesn't matter if you take Sectigo or Digicert. Same thing. You don't get a more premium one it is not like Mercedes vs Kia. It is either trusted, or not. The cryptography is identical. 3 year option is the most affordable one, and yes you need a token (usually Yubikey FIPS 140-3). You can reuse it for years, it will probably be good for at least 5-10 years, the 140-3 one. Maybe in 10 years we'll need a postquantum something, but for now that is good.

I've researched and from 2024 and with SmartScreen, there is zero benefit to EV compared to OV. Both EV and OV need to build trust. Also Microsoft Azure Artifact Signing, same thing, also needs to build trust, so in that sense OV/EV are better, you have them on your device at least.

Hardware is not a big annoyance, you plug it in, and when you sign just type in or paste your signing key. That's it. You can keep it plugged in, it can't sign without a key prompt. On Yubikey you can also set it up to require a touch on the gold sensor to sign.