Certifying windows executables? lazarus / 34-Windows ---------------------------------------------------------------------- Michael Collier · 2021-09-29 16:32 I notice Windows10 gives me/anyone a warning that a publisher is unknown after unzipping and attempting to run an exe. Has anyone ever "registered" and if so what authority did they register with, what was the experience like (slow/fast), cost etc?? My existing "certificates" are for HTTPS e.g. LetsEncrypt - but I'm assuming these are not the type I need for this? Thanks in advance, Mike ---------------------------------------------------------------------- Thaddy · 2021-09-29 16:49 Quote from: Michael Collier on September 29, 2021, 06:32:52 pmMy existing "certificates" are for HTTPS e.g. LetsEncrypt - but I'm assuming these are not the type I need for this? Correct. You will need a codesigning certificate from ultimately Microsoft, although third parties supply them too. (Again, ultimately Microsoft) Downside:There is some money involved. (not too much for professional use) Upside: FPC/Lazarus has a codesigning option through a package available from OPM. The same goes for Apple, btw. ---------------------------------------------------------------------- Michael Collier · 2021-09-29 17:53 Great - I installed CodeSigningHelper  - thanks Thaddy. For anyone else reading this in the future, the developers website is https://www.ccrdude.net/LazCodeSigningHelper/ The online package manager link wouldn't take me there (uses http rather than https). forum info: https://forum.lazarus.freepascal.org/index.php/topic,36861.0.html Plenty to read... thanks again ---------------------------------------------------------------------- skalogryz · 2021-09-29 17:57 Quote from: Michael Collier on September 29, 2021, 06:32:52 pmHas anyone ever "registered" and if so what authority did they register with, what was the experience like (slow/fast), cost etc?? Depends on the kind of the certificate you're trying to get. In order to have the application launching without any "questions", you'll need EV certificate to be purchased. It's costs around $500 (prices may vary, but I doubt you can find anything below $350). The approval might take about a week, since they will do the verification of your actual existence.  (The existence of your company). If they are prompt enough they might get you verified in a matter of a day or two. (for me it took about 3 weeks). Note that EV certificates are usually "hardware" generated. Meaning you'll have some sort of hardware device in order to sign an app. (The hardware device also needs to be mailed to you... which adds the time to the point when you can finally sign an app) You can get a simple certificate, but it will still show "running application by .... Name of your company" Simple certificates are cheaper.. about $100 Keep in mind that certificates expire and must be renewed (usually for  the same price, or a bit expensive, if you used some promo when buying the first certificate). Renewal process is as fast as simply paying for it. But if you miss the payment and don't renewal, you might have to pass the reapproval process again. You can't use your HTTPS certificate. Your HTTPS certificate was given for a domain name, not an executable. However, the same authority that issued your HTTPS certificate might also be providing code signing certificates (and you might  be eligible for a discount of some sort) ---------------------------------------------------------------------- Thaddy · 2021-09-29 18:55 Well $500 is a bit expensive. Depends on country it seems. (I pay in the region of the $100 you mentioned for a full one, directly from Microsoft, I have a msdn subsciption, though. That might be the cause I pay less for EV) You are correct that it needs to be renewed, but only for developers. Once an application is signed it needs no further renewals. Signed is signed and will stay "forever". Note it is also possible to self sign or internal sign - internal authority -, but that takes some administration for every user/machine. ---------------------------------------------------------------------- skalogryz · 2021-09-29 20:22 Quote from: Thaddy on September 29, 2021, 08:55:14 pm Well $500 is a bit expensive. Comodo Ev (i think one of the cheapest) $399 per year for Ev, without a promotion. Digicert $699 per year for Ev. ¯\_(ツ)_/¯ Quote from: Thaddy on September 29, 2021, 08:55:14 pmDepends on country it seems.No matter what the country is, we all live in the same digital space Quote from: Thaddy on September 29, 2021, 08:55:14 pmOnce an application is signed it needs no further renewals. Signed is signed and will stay "forever".Only if the app is signed with the timestamp (which is acquired via the proper certified server. Such server is usually provided by the party that issues the certificate). Otherwise the signature expires as well. Obviously everyone is using a timestamped signing. ---------------------------------------------------------------------- Michael Collier · 2021-09-29 20:28 If I do.. Menu->Project->Codesign Project->Attach code signature to executable I get message.. Error: Unable to find signing executable ! Not surprising, because at this stage I haven't configured anything, but I can't seem to find anywhere to set a path to signtool.exe on my hard drive. It was already on my drive at this location.. C:\Program Files (x86)\Microsoft SDKs\ClickOnce\SignTool\signtool.exe I don't have same configuration options as the image on designers website here: https://www.ccrdude.net/LazCodeSigningHelper/ide-options.png Any ideas? ---------------------------------------------------------------------- skalogryz · 2021-09-29 20:31 Quote from: Michael Collier on September 29, 2021, 10:28:35 pmAny ideas? try to use signtool from commandline A bit off-topic. So, far the only need of automated signing in IDE is only needed if the security settings prevent starting unsigned executables. Signging is usually needed when it's time to make a release or deploy the app elsewhere. ---------------------------------------------------------------------- Michael Collier · 2021-09-29 20:41 Thanks, signtool.exe runs from the command line, it gives expected errors that certificates were not found.. SignTool Error: No certificates were found that met all the given criteria. But isn't signtool.exe supposed to be fired from within the IDE -and give certificate errors from there? ---------------------------------------------------------------------- skalogryz · 2021-09-29 20:53 Quote from: Michael Collier on September 29, 2021, 10:41:39 pmBut isn't signtool.exe supposed to be fired from within the IDE -and give certificate errors from there? I'd think it is supposed to do that... but doesn't do it for some reason. ---------------------------------------------------------------------- Aidex · 2021-09-30 03:46 Hi! I use this "OV Code Signing Certificate" for my Windows software. The certificate costs around 80 euros per year. https://www.ksoftware.net/code-signing-certificates/ On that page you can also find a small freeware "kSign" to sign an .exe manually. For me this is a simple and relatively inexpensive solution. Regards, Jörg ---------------------------------------------------------------------- ASBzone · 2021-11-22 04:37 Quote from: Michael Collier on September 29, 2021, 06:32:52 pmI notice Windows10 gives me/anyone a warning that a publisher is unknown after unzipping and attempting to run an exe. Has anyone ever "registered" and if so what authority did they register with, what was the experience like (slow/fast), cost etc?? My existing "certificates" are for HTTPS e.g. LetsEncrypt - but I'm assuming these are not the type I need for this? Thanks in advance, Mike You need a code signing cert, and you can get them rather inexpensively (~US$70/yr) or very expensively (upwards of $500/year) See one source that I use to obtain mine (for the past 4 years):   https://cheapsslsecurity.com/sslproducts/codesigningcertificate.html ---------------------------------------------------------------------- ASBzone · 2021-11-22 04:38 Quote from: skalogryz on September 29, 2021, 10:31:27 pmQuote from: Michael Collier on September 29, 2021, 10:28:35 pmAny ideas? try to use signtool from commandline A bit off-topic. So, far the only need of automated signing in IDE is only needed if the security settings prevent starting unsigned executables. Signging is usually needed when it's time to make a release or deploy the app elsewhere. I also have a script that leverages SignTool from Microsoft... ---------------------------------------------------------------------- SymbolicFrank · 2021-11-22 08:10 The last time I did this, the difference in price was due to Microsoft SmartScreen. It is the thing that blocks people from running "unsafe" executables, which is: anything not on the whitelist. You can get on the whitelist if enough people run it anyway, or by paying for the expensive certificate. ---------------------------------------------------------------------- trev · 2021-11-22 09:18 Quote from: SymbolicFrank on November 22, 2021, 09:10:58 amYou can get on the whitelist if enough people run it anyway, or by paying for the expensive certificate. Or by gaming the system (ie downloading your signed executable enough times from any website with a clean reputation). Security ;-) ---------------------------------------------------------------------- AlexTP · 2021-11-22 09:21 I just stored the good info from this topic here: https://wiki.freepascal.org/Code_Signing_for_Windows ---------------------------------------------------------------------- Thaddy · 2025-04-15 08:17 You probably missed my point that Microsoft is the ultimate CA, also for the other certificate issues? Hence, the root CA is always Microsoft itself. ---------------------------------------------------------------------- PascalDragon · 2025-04-15 20:25 Quote from: Thaddy on April 15, 2025, 10:17:58 amYou probably missed my point that Microsoft is the ultimate CA, also for the other certificate issues? Hence, the root CA is always Microsoft itself. You're wrong. The only important point is that the Windows Certificate Store contains a root certificate for your code signing certificate (or the code signing certificate itself). For example the root certificate for the software we produce at work is from Sectigo, not Microsoft. Also for PowerShell scripts we use a code signing certificate which is signed from an intermediate certificate which is in turn signed from a custom, internal root certificate which is distributed to the company's computers through Group Policies. ---------------------------------------------------------------------- ASBzone · 2025-05-21 02:34 Quote from: boosted36 on April 15, 2025, 10:03:26 amThere are various CAs that offer different kind of code signing certs such as Standard and Extended Verification. Pricing also varies depending on it's type and brand. You can compare different brands here - https://signmycode.com/ And, just so everyone knows, as of 2023 the expense for code signing certs have gone up, and the requirements for how they are stored have increased. I renewed mine just a month ago, and it was a huge uplift over the old price I paid in 2019 and 2022.   But I did about 25% than the prices I saw in the link you used. ---------------------------------------------------------------------- Thaddy · 2025-05-21 05:41 It is still from $119 upto $189 for a standard code signing certificate, EV from $219. But the cheapest option is to register for the Microsoft store which is just $19 for a signing certificate and is perpetual. This is particularly useful if you have just 1 main piece of software that you want to distribute. This is information from Microsoft itself as per today. Btw: the store option does not tie you to the store like Apple does (tries to do: probably illegal in Europe). You can distribute your signed software through other channels too. BTW: I am prepared to pay for the store option for the MS platforms regarding the compilers. (Offer will likely not expire.) ---------------------------------------------------------------------- rvk · 2025-05-21 07:50 Quote from: Thaddy on May 21, 2025, 07:41:17 amIt is still from $119 upto $189 for a standard code signing certificate, EV from $219. Can you give a link to the one for $119 upto $189. (I'm not sure those ones still exists) Also... are you suggesting the $19 for the store includes a code signing certificate with which you can sign normal Windows executables? A link to that information would be great too. (But I don't think that store certificate is something you can really use for other programs) Edit: So it's only for actual distribution via the Microsoft Store. Not very helpful otherwise. QuoteWhen you submit an app to the Microsoft Store, Microsoft automatically signs your app with its own certificate during the submission process. This means you don't need to provide your own code signing certificate for apps distributed through the Microsoft Store. But I would still like the link to those other sites. ---------------------------------------------------------------------- Thaddy · 2025-05-21 08:14 Quote from: rvk on May 21, 2025, 09:50:12 amCan you give a link to the one for $119 upto $189. (I'm not sure those ones still exists) This was from this morning from Microsoft. Are you lazy? QuoteAlso... are you suggesting the $19 for the store includes a code signing certificate with which you can sign normal Windows executables? Just one, but other versions can be signed too at no cost. QuoteA link to that information would be great too. You ARE lazy. Quote(But I don't think that store certificate is something you can really use for other programs) The $19 option is not for a specific executable but for a specific piece of software that may change over time. Oh, can't you find the Microsoft developers website? No nonsense please, Rik. Oh wel that is enough for today. Looks like a duck (subsitute) walks like a duck, floats on water and therefor it is a.....witch..., ---------------------------------------------------------------------- Thaddy · 2025-05-21 08:18 https://www.ssl.com/ Even cheaper.............. Now shame you. I really don't get such...r*t*rds if I do not have enough coffee. ---------------------------------------------------------------------- rvk · 2025-05-21 08:23 Quote from: Thaddy on May 21, 2025, 10:14:02 amQuote from: rvk on May 21, 2025, 09:50:12 amCan you give a link to the one for $119 upto $189. (I'm not sure those ones still exists) This was from this morning from Microsoft. Are you lazy? No, I'm not lazy, I'm just calling your bullshit  And you can't sign your own executables with a Microsoft Developer account and distribute it. You can let Microsoft sign them when putting them in the Microsoft store and downloading them and then distribute them. Are you suggesting putting all the executables of Lazarus and FPC in the Microsoft Store ? Quote from: Thaddy on May 21, 2025, 10:18:02 amhttps://www.ssl.com/ Even cheaper.............. Now shame you. I really don't get such...r*t*rds if I do not have enough coffee.    Oooo, Thaddy... you didn't read it  That one for $64 is for 10 years. And yes... you can purchase one for $129 for one year... but look at the small print: QuotePricing Tier: Tier 1 Monthly - $20/Mo - 20 Signings - 1 Credential Credentials: 1 Total: $129.00So it's just for 20 signings. Please don't bullshit us (or at least provide the relevant details). A normal Code signing certificate with unlimited signings is running at least in (or close to) the $200's. ---------------------------------------------------------------------- Thaddy · 2025-05-21 08:24 Rik, Something was funny here: I asked Microsoft to provide me with an exact link, answer: we do not take sides, but the funny thing was that the only highlighted link was the cheapest. So AI is not impartial at all and in this case secretly pointed me to the cheapest link..... Oh, well, now we have to take care of such scenario's as well... ---------------------------------------------------------------------- rvk · 2025-05-21 08:25 Quote from: Thaddy on May 21, 2025, 10:24:52 amSo AI is not impartial at all and in this case secretly pointed me to the cheapest link..... Look at the number of signing you can do with that "cheapest" certificate !!!!!! ---------------------------------------------------------------------- Thaddy · 2025-05-21 08:26 The bullshit, you have to take that back. For one piece of software you do not need more, and updates can be signed too. Anyway, $119 is half my hourly rate, so is still peanuts and you can sign everything. ( I still do some consultancy ) ---------------------------------------------------------------------- rvk · 2025-05-21 08:45 Quote from: Thaddy on May 21, 2025, 10:26:02 amAnyway, $119 is half my hourly rate, so is still peanuts and you can sign everything. Yeah, I already decided to ignore your b$ as you didn't provide any links or provide information about the $19 method from Microsoft Store. (At least the Foundation already has a certificate, and I'm sure they pay more than $119) ---------------------------------------------------------------------- Thaddy · 2025-05-21 09:15 microsoft.com? That is real bullshit. DigiCert, Sectigo and GlobalSign all offer that in the range.  Comodo is slightly more expensive. You really did not check my information. Probably need some coffee too...  Oh, well, https://www.youtube.com/watch?v=0yq-Fw7C26Y Again a seasoned programmer being stupid on purpose. ---------------------------------------------------------------------- rvk · 2025-05-21 09:29 Quote from: Thaddy on May 21, 2025, 11:15:11 amDigiCert, Sectigo and GlobalSign all offer that in the range.  Comodo is slightly more expensive. I have a Sectigo certificate (via Xolphin) and nowadays it's definitely not in that range anymore. QuoteSectigo Code Signing Vanaf € 369 Per jaar* (Prijzen excl. BTW)https://www.sectigo.nl/digitalehandtekeningen/code-signing https://www.sectigo.com/ssl-certificates-tls/code-signing And via sslstore still above $200 (only when choosing 3 years otherwise it's well above $300). https://www.thesslstore.nl/products/code-signing-certificates.aspx But ok, if your half-hour rate is $119, that might not be too expensive  (Luckily I'm still on 3 years (with 1 extra year extended).) ---------------------------------------------------------------------- paweld · 2025-05-21 09:50 Quote from: rvkAnd yes... you can purchase one for $129 for one year... but look at the small print: QuotePricing Tier: Tier 1 Monthly - $20/Mo - 20 Signings - 1 Credential Credentials: 1 Total: $129.00So it's just for 20 signings. Please don't bullshit us (or at least provide the relevant details). @rvk - what you are writing about applies to the cloud signing service - there is no obligation to purchase this, then you need to put the certificate on a hardware usb token/HSM and no signature limit applies. Such a device costs about $300 with them Quote from: ThaddyDigiCert, Sectigo and GlobalSign all offer that in the range.  Comodo is slightly more expensive. All the certificates you listed cost well over $200 on the publisher's sites (Sectigo ~$340, DigiCert ~$580, GlobalSign ~430). I recommend checking before you write. ---------------------------------------------------------------------- Thaddy · 2025-05-21 11:11 The answer was from Microsoft, which is the licenser, not the licensee and as per today. (and the root certicate holder) It may be the case you have to ask for "best price". I am sure I am right. You do not know my phone book nor my email history. You do not even know who I am. ---------------------------------------------------------------------- paweld · 2025-05-21 11:46 Quote from: Thaddy on May 21, 2025, 01:11:33 pmThe answer was from Microsoft, which is the licenser, not the licensee and as per today. (and the root certicate holder) It may be the case you have to ask for "best price". I am sure I am right. You do not know my phone book nor my email history. You do not even know who I am. I, and I think most users, are interested in the actual price of the certificate - not the imaginary price I might get if I were you. You don't provide any sources to back up your words, so few will take them seriously. ---------------------------------------------------------------------- rvk · 2025-05-21 11:53 Quote from: paweld on May 21, 2025, 01:46:51 pmI, and I think most users, are interested in the actual price of the certificate - not the imaginary price I might get if I were you. You don't provide any sources to back up your words, so few will take them seriously. Yes, and the mentioned $19 for the Microsoft Store (where Microsoft signs it for you before putting it in the store) is only for MSIX/AppX packages. Not for EXE/MSI executables. For that Microsoft still requires you to sign with a trusted CA before submitting it to the Store. ---------------------------------------------------------------------- Thaddy · 2025-05-21 14:40 You can have msi signed. And, when you have an msdn subscription it is free. Google first, complain later..... Or use Bing for that matter.... Then the blind may see after all. ssl.com is $129 that is not far of $119 I mentioned. ---------------------------------------------------------------------- rvk · 2025-05-21 14:45 Quote from: Thaddy on May 21, 2025, 04:40:55 pmYou can have msi signed. Do you have a source of this statement? In the past it wasn't possible. Requirements: Quote4. Digital signature/code signing using a certificate from a trusted Certified Authority which is part of the Microsoft Trusted Root Program. Unlike the MSIX applications, which are signed automatically after successful validation by Microsoft, MSI and EXE applications must be digitally signed.https://www.advancedinstaller.com/publish-msi-exe-app- microsoft-store.html Article is from February 14th, 2024. I would love to know if this changed. Quote from: Thaddy on May 21, 2025, 04:40:55 pmGoogle first, complain later..... Or use Bing for that matter.... Then the blind may see after all. ssl.com is $129 that is not far of $119 I mentioned. Thaddy, please provide quotes and links before using those emojis. ---------------------------------------------------------------------- Thaddy · 2025-05-21 14:49 Lazy bastard, https://www.sslshopper.com/cheap-code-signing-certificates.html   That is gross. Profesionals stil working should simply know how to get the best price. Don't let me write that I have as much confidence in you, as you have in the wrong database engine choice you made. (because that would be an insult) ---------------------------------------------------------------------- rvk · 2025-05-21 14:51 Quote from: Thaddy on May 21, 2025, 04:49:40 pmLazy bastard, https://www.sslshopper.com/cheap-code-signing-certificates.html   That is gross. Profesionals stil working should simply know how to get the best price. I was talking about the MSI/EXE for Microsoft store. Show the source that Microsoft signs MSI. And $119 is not $129 so you are not correct either. Yes, it might be close but as said before, you need to invest more than €300 for the hardware. And stop using those emojis and swearwords. ---------------------------------------------------------------------- Thaddy · 2025-05-21 14:53 No. It is colorful. The source is not difficult for normal people: m.i.c.r.o.s.o.f.t...c.o.m. Did you know they even have a chatbot for support? Plain stupids. ---------------------------------------------------------------------- Thaddy · 2025-05-21 15:05 https://www.ssl.com/certificates/code-signing/ ---------------------------------------------------------------------- rvk · 2025-05-21 15:09 Quote from: Thaddy on May 21, 2025, 05:05:26 pmhttps://www.ssl.com/certificates/code-signing/ And add $279 for the key itself. But still haven't given the Microsoft quote. I have quoted a source which says it's not for EXE and MSI. Thaddy, our resident forum troll ---------------------------------------------------------------------- ASBzone · 2025-05-21 18:08 Quote from: Thaddy on May 21, 2025, 05:05:26 pmhttps://www.ssl.com/certificates/code-signing/ No doubt you've noticed that this is for a code signing cert that can only be used through their cloud portal on a subscription basis, so those are only the initial costs. And to sign MSI files, you need a 3rd party CA certificate.  There's no free or low-cost option from Microsoft for this.