certificatecode-signingcertificate-authority

If I code sign my Application (exe file) once with CA authorized certificate , will it reflect where ever I install it?


I am developing a desktop application. I can code sign it with .pfx file. I will get that from CA. But what if I want to install it in a different system. Will it reflect there as well? Because I can't share my .pfx file with everyone.


Solution

    1. You should not share the *pfx as it contains the private key.
    2. The trust to the signature comes from the trust chain - so when the issuing CA and all intermediate CAs up to the root CA are in the trust store (Windows Trust Store, MAC Key Chain or cacerts.pem for OpenSSL/Java) the signature is trusted as long as
      • the certificate is not revoked
      • the signature certificate is not expired or the signature contains a counter signature (RFC3161 timestamp).