EV Authenticode Signing using SignTool

Addressing weak verification and key protection

EV Code Signing addresses two of the most commonly used vulnerabilities malware developers leverage to spread their malicious code – weak identity verification processes and poor private key protection.

• Strict vetting process – Applicants for EV Code Signing certificates go through a more rigorous application process than regular code signing certificates. In addition to verifying the publisher’s organization name, other corporate information, such as physical address and jurisdiction, are vetted. This thorough verification process makes it much more difficult for malware developers to impersonate and obtain a code signing credential to use for signing malware under the guise of a legitimate development company.

• Certificate stored on USB token – Unlike regular code signing certificates that reside locally on a developer’s machine, all GlobalSign Code Signing certificates are stored on cryptographic tokens. This makes it much more difficult for a malicious party to copy or steal the private key and use it to sign malicious software under the identity of the actual certificate holder.

Automatic vs. manual

If you have more than one Code Signing Certificate on your computer, we recommend that you manually select which certificate to use for signing code. When running any of the SignTool commands, modify the section in red to match your filename(s). After running the command, you are prompted to enter your device’s password.

Automatically select signing certificate

To let Signtool automatically select the Code Signing Certificate to use to sign your program do the following:

Code signing сертификат разработчика для подписи программного обеспечения

Exclusive globalsign features

• Digitally sign an unlimited number of apps with a single certificate

• Access to GlobalSign’s superior support

• Compatible with major platforms (Authenticode, Office VBA, Java, Adobe AIR, Mac OS, Mozilla)

How is ev code signing different from standard code signing?

Here are the main differences:

• EV has a stricter validation process.
• EV certificates come on a physical token.
• EV is trusted by Microsoft SmartScreen.
• EV cannot be issued to individuals.

How to enable single logon for a safenet token

1. Open SafeNet Authentication Client Tools.

   Navigate to Start > Program Files > Safenet > Safenet Authentication Client Tools.

2. Click the Advanced View icon (gold gear).

3. In the menu tree in the left pane, select Client Settings.

4. In the right pane, select the Advanced tab.

5. On the Advanced tab, select the Enable single logon option.

6. Click Save.

7. To activate the single logon feature, log off from the computer and log on again.

How to get a microsoft ev code signing certificate

A Microsoft EV code signing certificate isn’t issued
directly by Microsoft. Rather, it’s issued by a certificate authority (CA) such
as Sectigo that’s trusted by Microsoft. Here’s how to get an EV code signing
certificate from Sectigo:

I’m an individual developer. can i get a microsoft ev code signing certificate?

Unfortunately, no. EV code signing certificates can only be
issued to organizations such as businesses.

Manually specify the ev code signing certificate to use

Using one of the manual SignTool commands specified below, you can select which certificate to use for publishing your programs.

Prepare token and computer

1. Secure token

   1. Using a DigiCert Supplied Secure Token

      Many customers will choose to have DigiCert ship a secure token to them. If this applies to you, you will need to do the following:

      1. Activate Token

         Activate your token and retrieve its password from within your DigiCert account.

      2. Install the Driver for the Safenet eToken Device

         During the token activation process, you are given the link to download and install the driver for the Safenet eToken device.

      3. Change eToken Password

         After obtaining your password, DigiCert recommends you change your etoken password as a security best practice.

   2. Using Your Own Secure Token

      If you are bringing your own FIPS 140-2 Level 2 compliant token from a different vendor, you need to do the following:

      1. Install Device Hardware

         Install your device’s hardware on your PC.

      2. Install EV Code Signing Certificate

         Install your EV Code Signing Certificate on your token before proceeding with these instructions.

2. Windows sdk

   Next, install the Windows SDK onto your computer.

Secure token

1. Using a DigiCert Supplied Secure Token

   Many customers will choose to have DigiCert ship a secure token to them. If this applies to you, you will need to do the following:

   1. Activate Token

      Activate your token and retrieve its password from within your DigiCert account.

   2. Install the Driver for the Safenet eToken Device

      During the token activation process, you are given the link to download and install the driver for the Safenet eToken device.

   3. Change eToken Password

      After obtaining your password, DigiCert recommends you change your etoken password as a security best practice.

2. Using Your Own Secure Token

   If you are bringing your own FIPS 140-2 Level 2 compliant token from a different vendor, you need to do the following:

   1. Install Device Hardware

      Install your device’s hardware on your PC.

   2. Install EV Code Signing Certificate

      Install your EV Code Signing Certificate on your token before proceeding with these instructions.

Sign your files

After your token and computer are ready, use the SignTool command to sign your program. You can run either the automatic or manual method below.

Note:     Microsoft will support SHA1 Code Signing Certificates until Jan 1, 2020. Microsoft recommends using SHA-256 certificate/digest algorithm/timestamp for all applications. Microsoft has not yet released a SHA1 deprecation policy for drivers. For more information, refer to the Windows Enforcement of Authenticode Code Signing and Timestamping page.

What is ev code signing?

EV stands for extended validation, and it means that the
software publisher goes through extra vetting before getting the code signing
certificate. It’s the ultimate customer assurance, which is why Microsoft
trusts it and removes SmartScreen warnings for software signed by it.

Windows sdk

Next, install the Windows SDK onto your computer.