P0-3: Windows code-signing certificate #18

New issue

Open

opened 2026-09-10 17:39:52 +00:00 by Cordy · 0 comments

Cordy commented

2026-09-10 17:39:52 +00:00

Owner

Manual task. Depends on P0-1.

The 2023 rule that changes everything

Since 1 June 2023, the CA/Browser Forum requires the private key for code-signing certificates to live on a FIPS 140-2 Level 2 or Common Criteria EAL 4+ hardware token or HSM. You can no longer receive a plain .pfx file and sign with it. This applies to both OV and EV.

Consequence for CI: the Windows build runner must either have the physical token attached, or use a cloud HSM signing service. Plan this before buying.

Two decisions, both counter-intuitive

1. Buy OV, not EV. EV certificates used to grant instant Microsoft SmartScreen reputation. They no longer do — EV-signed binaries now build reputation exactly like OV ones, and each new file hash resets reputation regardless. Buy EV only if enterprise procurement explicitly demands it, or if you ever sign kernel-mode drivers. Paying the EV premium to avoid SmartScreen warnings is money wasted.

2. Check Azure Trusted Signing eligibility first — it is probably unavailable to you. At ~$9.99/mo (Basic tier) it is by far the cheapest modern option and removes the physical-token problem entirely. But it is restricted to US, Canadian, EU or UK businesses. Switzerland is not in that list, so a Swiss entity likely does not qualify.

Verify Azure Trusted Signing eligibility for a Swiss GmbH before planning around it. This is a five-minute check that could save a few hundred francs a year.
If ineligible, buy a traditional OV certificate on a hardware token from a CA that ships to Switzerland (DigiCert, Sectigo, SSL.com).

Validity is now annual

From 15 February 2026, all newly issued or reissued code-signing certificates max out at 1-year validity. Multi-year certificates are gone. Put renewal in the calendar as a recurring annual task the day you buy it.

Steps

Verify Azure Trusted Signing eligibility.
Purchase OV certificate (token or cloud HSM).
Complete CA organisation validation — they will verify the entity against public records, so the Handelsregister entry must be live.
Receive and initialise the token; store it securely.
Test signtool sign /fd SHA256 /tr <timestamp-url> /td SHA256 against a throwaway binary.
Set a calendar reminder for renewal, 1 year minus 30 days.

Acceptance criteria

A test binary signs successfully and shows Swiss Cairn GmbH as publisher in its properties dialog.
Renewal reminder exists.
The signing approach is compatible with an automated Windows CI runner (documented either way).

**Manual task.** Depends on P0-1. ## The 2023 rule that changes everything Since **1 June 2023**, the CA/Browser Forum requires the private key for code-signing certificates to live on a **FIPS 140-2 Level 2 or Common Criteria EAL 4+ hardware token or HSM**. You can no longer receive a plain `.pfx` file and sign with it. This applies to both OV and EV. **Consequence for CI:** the Windows build runner must either have the physical token attached, or use a cloud HSM signing service. Plan this before buying. ## Two decisions, both counter-intuitive **1. Buy OV, not EV.** EV certificates used to grant instant Microsoft SmartScreen reputation. **They no longer do** — EV-signed binaries now build reputation exactly like OV ones, and each new file hash resets reputation regardless. Buy EV only if enterprise procurement explicitly demands it, or if you ever sign kernel-mode drivers. Paying the EV premium to avoid SmartScreen warnings is money wasted. **2. Check Azure Trusted Signing eligibility first — it is probably unavailable to you.** At ~$9.99/mo (Basic tier) it is by far the cheapest modern option and removes the physical-token problem entirely. **But it is restricted to US, Canadian, EU or UK businesses.** Switzerland is not in that list, so a Swiss entity likely does not qualify. - [ ] **Verify Azure Trusted Signing eligibility for a Swiss GmbH** before planning around it. This is a five-minute check that could save a few hundred francs a year. - [ ] If ineligible, buy a **traditional OV certificate on a hardware token** from a CA that ships to Switzerland (DigiCert, Sectigo, SSL.com). ## Validity is now annual From **15 February 2026**, all newly issued or reissued code-signing certificates max out at **1-year validity**. Multi-year certificates are gone. Put renewal in the calendar as a recurring annual task the day you buy it. ## Steps - [ ] Verify Azure Trusted Signing eligibility. - [ ] Purchase OV certificate (token or cloud HSM). - [ ] Complete CA organisation validation — they will verify the entity against public records, so the Handelsregister entry must be live. - [ ] Receive and initialise the token; store it securely. - [ ] Test `signtool sign /fd SHA256 /tr <timestamp-url> /td SHA256` against a throwaway binary. - [ ] **Set a calendar reminder for renewal, 1 year minus 30 days.** ## Acceptance criteria - A test binary signs successfully and shows `Swiss Cairn GmbH` as publisher in its properties dialog. - Renewal reminder exists. - The signing approach is compatible with an automated Windows CI runner (documented either way).