• Which the release of FS2020 we see an explosition of activity on the forun and of course we are very happy to see this. But having all questions about FS2020 in one forum becomes a bit messy. So therefore we would like to ask you all to use the following guidelines when posting your questions:

    • Tag FS2020 specific questions with the MSFS2020 tag.
    • Questions about making 3D assets can be posted in the 3D asset design forum. Either post them in the subforum of the modelling tool you use or in the general forum if they are general.
    • Questions about aircraft design can be posted in the Aircraft design forum
    • Questions about airport design can be posted in the FS2020 airport design forum. Once airport development tools have been updated for FS2020 you can post tool speciifc questions in the subforums of those tools as well of course.
    • Questions about terrain design can be posted in the FS2020 terrain design forum.
    • Questions about SimConnect can be posted in the SimConnect forum.

    Any other question that is not specific to an aspect of development or tool can be posted in the General chat forum.

    By following these guidelines we make sure that the forums remain easy to read for everybody and also that the right people can find your post to answer it.

Signing your Code

A

Alex Barrett

Messages
48
Country
unitedkingdom
Hi All,

With all the increased security coming up with FSX and Vista etc. I've started to think that perhaps I should be looking into the different methods of code signing.

Quite simply its not something I've done before, do I need to pay for a certificate, and how do I include that?

I see that CATIII Software have released the Code Signer Pro software, but that seems to require a .PFX file, which after a bit of research is created using the "MakeCert.exe" application, and then the "pvk2pfx.exe" one to turn it into the PFX itself.

I can then apparently sign my code with it using SignTool.exe (all of the above are found in the VS2005 install) or presumable CodeSigner Pro.

However it seems I need to buy a certificate for all this at $499 USD (VeriSign) PER YEAR minimum for the basic level.

Why would I bother paying that much if what I release will be mainly freeware?

I would certainly LIKE to do it as no doubt it helps with piece of mind for many users, which can only be a good thing.

So, firstly, is there any way of doing this all for free?

Secondly, if not so, then is there any way that we, as developers, could make a FS Industry certificate signing process.

This can then be made available to other developers, perhaps in a registered online database format, so the end FS user could be sure that the add on they downloaded is from the a responsible developer?

Is it possible to do this? Just needs to be enough to get FS to show the developer name when it asks if its a trusted source.

Hope to get a few replies from peoples thoughts here, I'm sure I'm not the only one who's thought about this.

Alex
 
You can do a self signed certificate. Technically it works, even tried with self signed installers. However no out of the box OS will recognize the certificate if you don't provide the public key and the user doesn't install it.

Personally what I'm doing is: distributing the key to some friends that are using a program that I did and needs to be signed. I don't even thought about buying anything related to certificates.

José
 
Last edited:
Alex Barrett said:
However it seems I need to buy a certificate for all this at $499 USD (VeriSign) PER YEAR minimum for the basic level.
Click to expand...

That is VERY expensive. GlobalSign do codesigning certificates for around €300 or so (i.e. about the same), but that's for a three year period. You could also check Thawte. VeriSign is the most well-known, but these others also have their roots incorporated into standard Windows installations.

Why would I bother paying that much if what I release will be mainly freeware?
Click to expand...

It probably isn't worth it, I agree. But it is actually cheaper than the tools I buy to do the development, so I count it in the same class -- another tool.

Secondly, if not so, then is there any way that we, as developers, could make a FS Industry certificate signing process.
Click to expand...

There was some discussion on this last year -- it'll be here some place still. I don't think anything ever came of it. Maybe it should be resurrected.

Is it possible to do this? Just needs to be enough to get FS to show the developer name when it asks if its a trusted source.
Click to expand...

It isn't FS but Windows which does that, and it's the IE part of Windows which manages the certificates and their roots and public keys. Once you had a reasonably sizeable group of developers all intent on managing a new cheaper certification system maybe Microsoft would incorporate the root details in a Windows update. Maybe. Or maybe they actually charge those Companies a lot of money for so doing and therefore wouldn't be interested ... I don't know.

Regards
Pete
 
You must log in or register to reply here.
Back
Top