Signotaur Code Signing Server - Looking for beta testers

[Vincent Parrett 762]

Hi All

 

We have developed a client/server product to handle code signing. This makes it simple to code sign from any machine and avoid the dreaded token password prompts. It also supports file based certificates for those who still have valid ones!

The client is a single exe (with a similar command line interface to signtool.exe) - 64 bit windows 10/Server 2016 or later (may run on earlier versions but not tested).

 

 

The server is supported on Windows 10/Server 2016 or later (may run on earlier versions but not tested). Linux support for the server is planned (we have it building but have not tested yet).

The server has a web interface for configuring it (adding certificates, managing users etc).

 

 

We have tested with Safenet tokens (with our own cert) and with Yubikey tokens (with self signed cert). It should work with any token that provides a 64bit pkcs#11 2.4 library dll.

We are especially interested in hearing from people with Yubikey tokens (since we have only tested with self signed cert).

The token needs to be available to the server machine, either plugged in directly or via usb passthrough for vms, or via virtualhere.

We’re still working on docs but it’s pretty simple to get up and running with it, we’ll provide some instructions with the download info etc.

If you are interested in testing this product email support @ finalbuilder.com - let us know what kind of token you have.

Edited October 25 by Vincent Parrett
fixed images

[Mark- 29]

> We are especially interested in hearing from people with Yubikey tokens

 

Which Yubikey series would you support?

And would code signing be able to be automated with your "client/server product"?

 

[Vincent Parrett 762]

18 minutes ago, Mark- said:

Which Yubikey series would you support?

Any yubikey capable of containing a code signing certificate and supported by the yubikey pkcs#11 driver (installed with their PIV tool). We have tested with a 5C and a 5 Nano. 

28 minutes ago, Mark- said:

And would code signing be able to be automated with your "client/server product"?

Yes, that's the main reason we developed the product (for our own use initially) - once you have configured the token/certificate on the server (via the web interface) then signing is done using the client with an api key - no password prompts. 
PM me if you are interested in testing - we're currently working on documentation and the website with a view to releasing as soon as they are done ( we have had some great feedback already). 

Also if anyone has a certificate issued by Certum and wants to test Signotuar please message me - I have a certum token/smartcard - but they didn't provide the puk so I can install certs on it for testing. 

[Vincent Parrett 762]

Hi All

 

Signotaur Code Signing Server -  Release Candidate 1 is available 

 

https://www.finalbuilder.com/downloads/signotaur

To get a license key, once installed and logged in, go to the Admin\Licenses page and click on the "Request a 14-day trial license" button - the server will contact our website and download an install a trial key automatically. 

 

Docs are here 

https://docs.finalbuilder.com/sn/1.0/

 

Note - only tested with Safenet and Yubikey tokens, pfx files and certificate stores so far.  

[Anders Melander 1815]

4 hours ago, Vincent Parrett said:

Signotaur Code Signing Server -  Release Candidate 1 is available

Well, aren't I the lucky one? I've just been tasked with finding a code signing solution for our build pipeline.

So far the realistic candidates are:

1. Use Bob's test-server PC in the closet and do it manually (Bob's not too thrilled).
2. Use the certificate providers cloud solution and pay per transaction (not gonna happen).
3. Some clever tool that seems to be designed just for our needs.

So do you have any idea about what the price will be on this thing?

[Mark- 29]

15 minutes ago, Anders Melander said:

1. Use the certificate providers cloud solution and pay per transaction (not gonna happen).

So do you have any idea about what the price will be on this thing?

Yes our previous cloud solution went to the per transaction model and our cost would have gone up over 1000%. Not going to happen.

Yes, #2, the pricing page had no data.

 

Funny, before adding code signing, many years ago, not one customer asked for it or made a comment about it. We have wondered if we removed it, would it have any negative effects.

 

[Vincent Parrett 762]

3 hours ago, Anders Melander said:

So do you have any idea about what the price will be on this thing?

Obviously we have to take into account the competition (cloud), the fact that potential customers have already dropped $$$ on certificates, the cost of supporting it and of course we need to make a profit to make this all worthwhile (10 monthss of R&D).  USD$199 is our current thinking.

[Vincent Parrett 762]

2 hours ago, Mark- said:

Funny, before adding code signing, many years ago, not one customer asked for it or made a comment about it. We have wondered if we removed it, would it have any negative effects.

They will get smartscreen popup's about how dangerous it is to use your product. 

[Vincent Parrett 762]

2 hours ago, Mark- said:

Yes, #2, the pricing page had no data.

We're still fleshing out the web pages (and working on a new website at the same time). 

[Anders Melander 1815]

7 minutes ago, Vincent Parrett said:

USD$199 is our current thinking.

Seems reasonable; I'll go ahead with that. Even if it ends up a bit higher I wouldn't see a problem with that (for us anyway) but don't let that influence you 🙂 

Thanks.

 

8 minutes ago, Vincent Parrett said:

They will get smartscreen popup's about how dangerous it is to use your product. 

Which is also the only reason we need it.

Well, to be perfectly honest, although FUDscreen is annoying, I suppose it does guard against the binaries getting tampered with (e.g. infected) after install. They could have solved that another way though but we all gotta have something to do. Who said you can't survive on cutting each others hair (is that even a saying in English?).

 

13 minutes ago, Vincent Parrett said:

We're still fleshing out the web pages

You misspelled TBD, if that was what it was supposed to say.

[Vincent Parrett 762]

4 minutes ago, Anders Melander said:

Seems reasonable; I'll go ahead with that. Even if it ends up a bit higher I wouldn't see a problem with that (for us anyway) but don't let that influence you 🙂 

Of course I'd love to be charging more, but the market probably wouldn't agree. I have been agonising over this for months - naming and pricing - both difficult aspects of turning projects into products. 

7 minutes ago, Anders Melander said:

Which is also the only reason we need it.

Well, to be perfectly honest, although FUDscreen is annoying, I suppose it does guard against the binaries getting tampered with (e.g. infected) after install. They could have solved that another way though but we all gotta have something to do.

It's all about the provenance of the executable - does it come from who it says it does. Codesigning is ok, smartscreen isn't so smart - I see popups even with EV signed exe's just because not msany people have downloaded a file.

 

13 minutes ago, Anders Melander said:

Who said you can't survive on cutting each others hair (is that even a saying in English?).

Can't say I have heard of it but I like it!

[Mark- 29]

33 minutes ago, Vincent Parrett said:

They will get smartscreen popup's about how dangerous it is to use your product. 

True.

Is that issue a negative for customers. Don't know.

[Uwe Raabe 2063]

1 hour ago, Mark- said:

Is that issue a negative for customers.

When you sell to larger companies? Definitely! Most likely they will never make it to be your customers.

[Brandon Staggs 283]

1 hour ago, Vincent Parrett said:

I see popups even with EV signed exe's just because not msany people have downloaded a file.

 

One of the supposed benefits to an EV cert is that it comes with instant SmartScreen rep. My own experience was than the first time I signed with my EV cert nobody saw any SmartScreen warnings, which was never the case when I first used cheaper certs in the past.

 

Do different browsers use their own screening systems? Windows + Edge should be consistent, but maybe other browsers don't care what SmartScreen thinks?

[Vincent Parrett 762]

It's more about the first time you launch the exe - I have seen warnings even with apps signed with EV certs - possibly it because it was a new update of an app - I was surprised - so I checked that the exe was signed just in case - it was - launched it again and no popup 💁‍♂️

[JonRobertson 72]

If your customers use an Endpoint Protection and Response product, code signing is critical. The one we use sometimes complains even when the executable is signed with a valid certificate. It is a pain in the rear. But it is essential due to the number and sophistication of cyber threats today. Two-factor or multi-factor authentication is also a pain that I have to put up with daily. I can't do my job without my phone. 

 

The Internet is a tremendous resource. But there are days that I miss the simplicity of 8-bit computing.

[mvanrijnen 123]

16 hours ago, JonRobertson said:

If your customers use an Endpoint Protection and Response product, code signing is critical. The one we use sometimes complains even when the executable is signed with a valid certificate. It is a pain in the rear. But it is essential due to the number and sophistication of cyber threats today. Two-factor or multi-factor authentication is also a pain that I have to put up with daily. I can't do my job without my phone. 

 

The Internet is a tremendous resource. But there are days that I miss the simplicity of 8-bit computing.

 

So we create only software for internal use, using (at the moment) , do we benefit from code signing ? 

 

[JonRobertson 72]

11 minutes ago, mvanrijnen said:

So we create only software for internal use, using (at the moment) , do we benefit from code signing ?

Are your computers connected to the Internet? Any application can be hijacked by an intrusion from the outside, even applications developed internally.

[mvanrijnen 123]

9 minutes ago, JonRobertson said:

Are your computers connected to the Internet? Any application can be hijacked by an intrusion from the outside, even applications developed internally.

Yes. my question  was more, (a discussion  i had on this forum a few years ago also), do we benefit  for preventing false positives using signing (makes it easier turning the mgmt in positive direction, so they don't only see it as a cost) ?

(we are going to implement signing anyway).

 

Edited November 19 by mvanrijnen

[JonRobertson 72]

9 minutes ago, mvanrijnen said:

do we benefit  for preventing false positives using signing

I suspect that depends on the software scanning for virus and malware. My suspicion is that scanners don't care whether applications are signed, because there is nothing that prevents me from applying a security certificate to malicious code. Especially if the certificate cannot be traced back to me.

[DelphiUdIT 187]

6 hours ago, JonRobertson said:

I suspect that depends on the software scanning for virus and malware. My suspicion is that scanners don't care whether applications are signed, because there is nothing that prevents me from applying a security certificate to malicious code. Especially if the certificate cannot be traced back to me.

A public signature is subject to revocation, which I can imagine would happen very quickly if a malware signature is verified.
Also, the signature would be easily identifiable and the malware could therefore be blocked in virtually "zero time".

[Angus Robertson 577]

The concept of certificate revocation is changing due to the slow down it causes and the massive databases needed.  OCSP seems to be dead with browsers no longer using it (CRL instead), Let's Encrypt is stopping it's OSCP servers service soon.  The industry wants certificate life to be shorter so they are replaced regularly (monthly) rather than being revoked.  

 

But this is not really relevant to code signing, since expired certificates are usually trusted provided they are time stamped signed, Azure issues code signing certificates that expire within two days or something.  You can only revoke unexpired certificates, and our signed applications need to run for years or decades, thus the time stamp.  

 

In theory, the OS or scanners could try and check old signing certificates being revoked, but it would not be easy.

 

Angus

 

[DelphiUdIT 187]

A digital signature remains valid until it or the issuing certificate (chain trust) is revoked. When it expires in time, it is still considered valid.
You cannot use a certificateto for signing purpose that has already expired, obviously.

As for OSCP and CRL, in any case the possibility of invalidating a signature (or a certificate) must be guaranteed ... it is the basis of the concept of public signature.

I don't know for how long it will still be possible to use "file" certificates like those of LET'S Encrypt for uses other than simple SSL ... the legislation (for example the Italian one) considers the digital signature valid ONLY and EXCLUSIVELY if produced by HARDWARE devices (specific), and it seems to me that the rest of the world follows this.

So certificates with a validity of less than 1 year are not feasible if combined with classic USB TOKENS for example.

 

Bye

[chillefeld 1]

Is support for signing powershell scripts planned for the release version?

The RC does not support it but unfortunately we need it.

[Vincent Parrett 762]

19 minutes ago, chillefeld said:

Is support for signing powershell scripts planned for the release version?

The RC does not support it but unfortunately we need it.

Yes, it works in our testing here with the RC (v1.0.0.319) - what happens when you try it? 
 

C:\Temp>SignotaurTool.exe sign -a MYAPIKEY -s https://ciagent005:91 --allow-untrusted --fd=SHA256 -t 56DFCD0B0C37DD1B9AB75FFCAB6627745E6E93B6 -d="A Test" test.ps1
+----------------------------------------------------------------------------------------------------------------------+
|  SignotaurClient                                                                                                     |
|  Version : 1.0.0.324                                                                                                 |
|  © 2024 VSoft Technologies Pty Ltd                                                                                   |
|                                                                                                                      |
+----------------------------------------------------------------------------------------------------------------------+
20:01:30 The following certificate was selected:
        Issued to:      CN=VSoft Technologies Pty Ltd, O=VSoft Technologies Pty Ltd, L=Canberra, S=Australian Capital Territory, C=AU
        Issued by:      CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1, O=EnVers Group SIA, C=LV
        Expires:        09/05/2026 09:59:59
20:01:30 Signing 1 files.
20:01:30 Sending sign request to server for file C:\Temp\test.ps1 (size: 47 B) ...
20:01:32 C:\Temp\test.ps1 signed successfully.

Exit code: 0
20:01:32 Execution time: 00:00:02.2759870

And when I test running the script
 

PS C:\temp> Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy allsigned
PS C:\temp> .\test.ps1

Do you want to run software from this untrusted publisher?
File C:\temp\test.ps1 is published by CN=VSoft Technologies Pty Ltd, O=VSoft Technologies Pty Ltd, L=Canberra,
S=Australian Capital Territory, C=AU and is not trusted on your system. Only run scripts from trusted publishers.
[V] Never run  [D] Do not run  [R] Run once  [A] Always run  [?] Help (default is "D"): a
I am signed thanks to Signotaur!
PS C:\temp>