3 ms·

Furthermore, I don't believe there is a LetsEncrypt equivalent for code signing.

• jacobush 9y ago
  Also harder to implement. With letsencrypt you prove you control the domain and the DNS. How do you prove you control software?
  • nailer 9y ago
    It's the same process as EV - verify the public key is controlled by a real world legal entity. Validation process depends on the entity type, but usually a combination of government and private business registrars, and verification phone calls. Sometimes ID inspection for sole traders (since in their case the legal entity is a person).
    • jacobush 9y ago
      Yes, but this does not lend itself to automation, hence free as letsencrypt does.
      • nailer 9y ago
        Not entirely, but reducing EV verification times is my job at https://certsimple.com https://certsimple.com. There's a lot that can be done and most CAs tech to handle the problem is at least a decade old. Also: ACME for EV is coming.
        • jacobush 9y ago
          Cool. I’ll send you an email.