Code Signing

What is Code Signing?

Why is Code Signing Important for Software Installation?

During installation, code signing guarantees that the software package is authentic and intact. This prevents attackers from injecting harmful code and reassures users that the application originates from a verified source. Operating systems and browsers often block unsigned or improperly signed installers, making code signing essential for smooth deployment.

How Does Code Signing Work?

The process typically includes: 

• Developer signs the code using a private key.
• A digital certificate from a trusted CA validates the publisher’s identity.
• End-user systems verify the signature before installation.

Code Signing Best Practices: Our Top Tips

 1. Use Strong Cryptographic Keys and Secure Storage

Always generate signing keys within a FIPS-compliant device, such as a hardware security module (HSM), rather than storing private keys in files (e.g., PFX) on build servers. This prevents key theft and unauthorised code signing. 

2. Leverage Certificate Authorities and Chain of Trust

Obtain code signing certificates from recognised Certificate Authorities (CAs) that are trusted by major operating systems (Windows, macOS, Linux).

Ensure your signing process supports the full chain of trust: public key, intermediate certificate, and root certificate. This guarantees that signatures are universally verifiable during installation. 

3. Implement Time Stamping

Always time stamp your signed software. Time stamping ensures that signatures remain valid even after the certificate expires, which is critical for long-life products and devices. This extends trust and avoids installation failures years after release.

4. Adopt Short-Term Certificates and Lifecycle Management

Use short-term certificates (valid for less than a year) where possible, especially in regulated industries. This allows for frequent key rotation, rapid compliance updates, and reduces the risk of long-term key exposure.

Maintain robust certificate lifecycle management to ensure keys and certificates are renewed and rotated regularly. 

5. Choose the Right Trust Model

For public distribution, use Public Trust Code Signing certificates to ensure broad recognition and compliance with industry standards.

For internal or consortium use, Private Trust Code Signing may offer more control and flexibility but requires careful management of your own trust hierarchy and infrastructure. 

6. Integrate Code Signing into Your Build and Installation Process

Use tools like InstallShield or similar to automate and customise the signing process for both binaries and installers. Ensure your installation workflow verifies digital signatures and blocks unsigned or improperly signed binaries, aligning with modern OS requirements (e.g., Windows 11). 

7. Monitor and Respond to Evolving Standards

Stay informed about updates from the CAB Forum and other regulatory bodies, as standards for code signing (e.g., validity periods, hardware requirements) continue to evolve. Be proactive in updating your signing practices to maintain compliance and security.

Watch this short video to learn more about InstallShield: