4 ms·

Even for our company, we would fork over the $600 but it looks like all of the EV cert options require a hardware signing key. Putting a human in the loop for o

Even for our company, we would fork over the $600 but it looks like all of the EV cert options require a hardware signing key. Putting a human in the loop for our otherwise fully automated release process is a non-starter.

maille 5y ago
You can automate code signing using Microsoft azure key vault. I did it last month, no need for a dongle nor a pin number
- judge2020 5y ago
  Also, Microsoft is working on a code signing service called Azure Code Signing where Microsoft issues and manages the certificate and keys and you simply upload binaries/app packages to Azure which does the signing. As far as I can tell, the video is the only public information on the non-GA service: https://youtu.be/Wi-4WdpKm5E?t=529 https://youtu.be/Wi-4WdpKm5E?t=529
  - donmcronald 5y ago
    That sounds like abuse of a monopoly position to me. They keep the horrendous status quo as bad as possible so their new product looks good by comparison. I’m ready for bipartisan gutting of big tech.
- swiley 5y ago
  It's iOS all over again. Computing freedom is something only enthusiasts have now.
- adamparsons 5y ago
  So MS sells a solution to a problem they caused? fantastic, whats new.
viraptor 5y ago
Sounds like the hardware key requires a pin, but not physical presence (i.e. not a button touch), so it can be automated https://stackoverflow.com/questions/17927895/automate-extended-validation-ev-code-signing/ https://stackoverflow.com/questions/17927895/automate-extend...
- inspector-g 5y ago
  One of my clients has strict requirements for an automated build process, and we managed to use an EV code signing cert on a YubiKey w/ PIN - so it’s definitely possible with a little leg work. After having gone through it, I agree with other posts that the main annoyance is the verification process and weeks of delays/back-and-forth. That, and the inconvenience of now having a single point of failure in the build process (unless multiple certs are purchased).
  - traceroute66 5y ago
    > inconvenience of now having a single point of failure in the build process (unless multiple certs are purchased). Except that's not quite true is it. Most (all ?) devices (even the cheap USB ones) have secure wrapped backup/restore mechanisms. All you had to do was set up your device correctly in the first place (since the wrapping can't be activated retrospectively). Some of the cert vendors even have ready-made instructions available to follow on their website telling you exactly how to do this: https://www.ssltrust.co.uk/help/setup-guides/mofn-setup-nitrokey-hsm https://www.ssltrust.co.uk/help/setup-guides/mofn-setup-nitr... RTFM as they say. ;-)
    - inspector-g 5y ago
      Correct me if I'm wrong, but when a fully preconfigured YubiKey is shipped to you as part of the EV cert fulfillment, then there is no way to do this after-the-fact.
traceroute66 5y ago
> Putting a human in the loop for our otherwise fully automated release process is a non-starter. I don't follow. The purpose of storing keys in hardware is to irreversibly protect the key. If you then wish to be silly and hardcode the PIN to the hardware in your release scripts, then that is your prerogative. If its the cost of an HSM you're alluding to, even that is a non-issue with a Yubikey or Nitrokey.
evanelias 5y ago
Worse still, the SafeNet software that my cert vendor recommends using (to interact with the hardware key) doesn't even allow use of Remote Desktop sessions! It somehow detects if you're in an RDP session, and shows that there are no hardware tokens attached if that's the case. No message or warning whatsoever. My only Windows PC is headless and I lost several hours trying to debug this. The entire EV cert process is such an outrage. My cert vendor advertised that the validation process would take 2-3 business days if all docs were in order, DUNS info correct, etc. I spent a lot of time ahead of the order ensuring the docs were indeed in order, and the process still inexplicably took 9 business days.
- rstupek 5y ago
  Oh man I totally got hit by that and never did figure out being in rdp was the reason!
- geitir 5y ago
  Maybe try something like TeamViewer since rdp virtualizes the display adapter and likely other things
  - viraptor 5y ago
    It's not about virtualisation. RDP sessions are actually marked as remote login sessions. The login source can be checked easily in each app. (or just run `net session`) If TeamViewer acts on an already logged-in local session, it should work well.
- cjensen 5y ago
  One way around SafeNet is to run the builder in a VM, then RDP into the host.
  - vb6sp6 5y ago
    or use vnc, teamviewer, etc
- josephcsible 5y ago
R0b0t1 5y ago
You can wire up a microcontroller to push the button as part of your CI/CD.
- donmcronald 5y ago
  This is a hilarious solution that I would love to see gain popularity. Lol.
  - R0b0t1 5y ago
    People are actually using it. I have some vague interest in Windows driver development and this hardware token requirement hit there first.
    - deleted 5y ago
      [deleted]
Stratoscope 5y ago
Back in 2014 I was working at AltspaceVR (a social virtual reality startup) and we had Mac and Windows versions of the product. I set up a Mac Mini at the office to do the Mac builds, and it also ran a Windows VM under Parallels to do the Windows code signing. (The actual Windows builds ran in the cloud and we sent them down to the Windows VM for signing and then it sent them back up to the cloud.) We had a Digicert code signing certificate that used a hardware key connected to the Windows VM. Unfortunately it required a password to be manually entered each time the code was signed. To automate this, I wrote a little AutoHotkey script that watched for the password dialog and entered the password. There wasn't any RDP issue because we didn't use RDP, just a Windows VM that didn't need any user intervention. (It could have been a separate physical machine, but since we had the Mini anyway and it had the capacity, it was convenient to have it do both the Mac builds and the Windows code signing.) I sometimes think there are few problems that AutoHotkey cannot solve.
- avipars 5y ago
  Agreed, AutoHotkey is awesome!
michaelt 5y ago
Of course, there's a kinda reasonable reason for the hardware token requirement: Widely publicised 2010 virus 'StuxNet' had a driver signature, using a stolen copy of Realtek's driver signing certificate. [1] And stolen certificates make the whole code-signing house of cards falls apart - you can't trust something signed by Realtek if it was not, in fact, signed by Realtek! Of course, hardware tokens aren't a panacea: Some malware authors simply set up a shell company and get a certificate issued to that company. [1] https://www.trendmicro.com/en_us/research/18/d/understanding-code-signing-abuse-in-malware-campaigns.html https://www.trendmicro.com/en_us/research/18/d/understanding...
stinos 5y ago
You need the key, but there are ways to get a .pfx out of it. Which I unfortunately don't remember, but that is probably documented by whoever you got the key from. And otherwise signtool can be used with the key, though it is not always trivial to get working.
vb6sp6 5y ago
yeah, i thought this too but it was really easy to automate

maille 5y ago

You can automate code signing using Microsoft azure key vault. I did it last month, no need for a dongle nor a pin number

judge2020 5y ago
Also, Microsoft is working on a code signing service called Azure Code Signing where Microsoft issues and manages the certificate and keys and you simply upload binaries/app packages to Azure which does the signing. As far as I can tell, the video is the only public information on the non-GA service: https://youtu.be/Wi-4WdpKm5E?t=529 https://youtu.be/Wi-4WdpKm5E?t=529
- donmcronald 5y ago
  That sounds like abuse of a monopoly position to me. They keep the horrendous status quo as bad as possible so their new product looks good by comparison. I’m ready for bipartisan gutting of big tech.
swiley 5y ago
It's iOS all over again. Computing freedom is something only enthusiasts have now.
adamparsons 5y ago
So MS sells a solution to a problem they caused? fantastic, whats new.

viraptor 5y ago

Sounds like the hardware key requires a pin, but not physical presence (i.e. not a button touch), so it can be automated https://stackoverflow.com/questions/17927895/automate-extended-validation-ev-code-signing/ https://stackoverflow.com/questions/17927895/automate-extend...

inspector-g 5y ago
One of my clients has strict requirements for an automated build process, and we managed to use an EV code signing cert on a YubiKey w/ PIN - so it’s definitely possible with a little leg work. After having gone through it, I agree with other posts that the main annoyance is the verification process and weeks of delays/back-and-forth. That, and the inconvenience of now having a single point of failure in the build process (unless multiple certs are purchased).
- traceroute66 5y ago
  > inconvenience of now having a single point of failure in the build process (unless multiple certs are purchased). Except that's not quite true is it. Most (all ?) devices (even the cheap USB ones) have secure wrapped backup/restore mechanisms. All you had to do was set up your device correctly in the first place (since the wrapping can't be activated retrospectively). Some of the cert vendors even have ready-made instructions available to follow on their website telling you exactly how to do this: https://www.ssltrust.co.uk/help/setup-guides/mofn-setup-nitrokey-hsm https://www.ssltrust.co.uk/help/setup-guides/mofn-setup-nitr... RTFM as they say. ;-)
  - inspector-g 5y ago
    Correct me if I'm wrong, but when a fully preconfigured YubiKey is shipped to you as part of the EV cert fulfillment, then there is no way to do this after-the-fact.

traceroute66 5y ago

> Putting a human in the loop for our otherwise fully automated release process is a non-starter. I don't follow. The purpose of storing keys in hardware is to irreversibly protect the key. If you then wish to be silly and hardcode the PIN to the hardware in your release scripts, then that is your prerogative. If its the cost of an HSM you're alluding to, even that is a non-issue with a Yubikey or Nitrokey.

evanelias 5y ago

Worse still, the SafeNet software that my cert vendor recommends using (to interact with the hardware key) doesn't even allow use of Remote Desktop sessions! It somehow detects if you're in an RDP session, and shows that there are no hardware tokens attached if that's the case. No message or warning whatsoever. My only Windows PC is headless and I lost several hours trying to debug this. The entire EV cert process is such an outrage. My cert vendor advertised that the validation process would take 2-3 business days if all docs were in order, DUNS info correct, etc. I spent a lot of time ahead of the order ensuring the docs were indeed in order, and the process still inexplicably took 9 business days.

rstupek 5y ago
Oh man I totally got hit by that and never did figure out being in rdp was the reason!
geitir 5y ago
Maybe try something like TeamViewer since rdp virtualizes the display adapter and likely other things
- viraptor 5y ago
  It's not about virtualisation. RDP sessions are actually marked as remote login sessions. The login source can be checked easily in each app. (or just run `net session`) If TeamViewer acts on an already logged-in local session, it should work well.
cjensen 5y ago
One way around SafeNet is to run the builder in a VM, then RDP into the host.
- vb6sp6 5y ago
  or use vnc, teamviewer, etc
josephcsible 5y ago

R0b0t1 5y ago

You can wire up a microcontroller to push the button as part of your CI/CD.

donmcronald 5y ago
This is a hilarious solution that I would love to see gain popularity. Lol.
- R0b0t1 5y ago
  People are actually using it. I have some vague interest in Windows driver development and this hardware token requirement hit there first.
  - deleted 5y ago
    [deleted]

Stratoscope 5y ago

Back in 2014 I was working at AltspaceVR (a social virtual reality startup) and we had Mac and Windows versions of the product. I set up a Mac Mini at the office to do the Mac builds, and it also ran a Windows VM under Parallels to do the Windows code signing. (The actual Windows builds ran in the cloud and we sent them down to the Windows VM for signing and then it sent them back up to the cloud.) We had a Digicert code signing certificate that used a hardware key connected to the Windows VM. Unfortunately it required a password to be manually entered each time the code was signed. To automate this, I wrote a little AutoHotkey script that watched for the password dialog and entered the password. There wasn't any RDP issue because we didn't use RDP, just a Windows VM that didn't need any user intervention. (It could have been a separate physical machine, but since we had the Mini anyway and it had the capacity, it was convenient to have it do both the Mac builds and the Windows code signing.) I sometimes think there are few problems that AutoHotkey cannot solve.

avipars 5y ago
Agreed, AutoHotkey is awesome!

michaelt 5y ago

Of course, there's a kinda reasonable reason for the hardware token requirement: Widely publicised 2010 virus 'StuxNet' had a driver signature, using a stolen copy of Realtek's driver signing certificate. [1] And stolen certificates make the whole code-signing house of cards falls apart - you can't trust something signed by Realtek if it was not, in fact, signed by Realtek! Of course, hardware tokens aren't a panacea: Some malware authors simply set up a shell company and get a certificate issued to that company. [1] https://www.trendmicro.com/en_us/research/18/d/understanding-code-signing-abuse-in-malware-campaigns.html https://www.trendmicro.com/en_us/research/18/d/understanding...

stinos 5y ago

You need the key, but there are ways to get a .pfx out of it. Which I unfortunately don't remember, but that is probably documented by whoever you got the key from. And otherwise signtool can be used with the key, though it is not always trivial to get working.

vb6sp6 5y ago

yeah, i thought this too but it was really easy to automate