search

FreeCAD / FPA

The FreeCAD Project Association
24 stars 22 forks source link

Get a CA certificate for the FPA #73

Open yorikvanhavre opened 1 year ago

yorikvanhavre commented 1 year ago

A CA certificate is a certificate issued by an authority (as opposed to a self-signed certificate), that certifies your identity. CA certificates are commonly used on websites, but can also be used to sign applications. CA certifcates can usually be purchased in different flavours (individual or corporate, with or without subdomains). It costs between USD 200 and 350 a year.

Note Linux Appimages are typically signed with gpg keys, and Apple installers with Apple developer IDs. So a CA certificate would basically only be of use to sign Windows packages. So purchasing a CA certificate would have two uses for the FPA:

A corporate, subdomain-enabled CA certificate would cost around USD 250 / year, would display "The FreeCAD project association" as the owner when someone requests security details at freecad.org, and would make the FreeCAD Windows installer signed by the FPA.

Microsoft recommends purchasing a certificate from their "partners" but they are more pricey at about USD 350 for a corporate certificate. Gandi.net, where the freecad.org domain is registered, also sells CA corp certifcates for around USD 250. Description of Pro certificates

Certificates come as SSL certificates which can be directly used with websites, but can also easily be converted to the pfx format (other tutorial) which is used by the signtool.exe tool to sign Windows executables.

The certificate comes as a SSL certificate and can be immediately used on websites, and can

adrianinsaval commented 1 year ago

Are they really the same? from what I understand a code signing certificate (for windows) is different from an SSL certificate.

And there seems to be different tiers for code signing certificates: https://stackoverflow.com/questions/48946680/how-to-avoid-the-windows-defender-smartscreen-prevented-an-unrecognized-app-fro/66582477#66582477

here certificates are offered with discount for opensource projects: https://shop.certum.eu/data-safety/code-signing-certificates.html?as_code_signing_rodzaj=5651

bot it's not clear to me if it's OV or EV

yorikvanhavre commented 1 year ago

What I read everywhere is that you can convert any ssl certificate to pfx if you have a crt file that the authority provides too. So the thing is to verify that point prior to buying.

But there is one thing I was not aware, Microsoft has a list of trusted authorities. Buying a certificate outside of those approved apparently is not much better than a self-signed one. Gandi is not in that list, so that option is not good for us.

The certum cert is interesting, it's cheap, and certum is in the approved list. But indeed I can't find if it includes verification of the FPA (that would be EV) or not. It also seems to come with a complex bundle of card reader and proprietary system... Might not be very practical, because it will allow only one person (who has the card) to sign

I think we need to look further...

adrianinsaval commented 1 year ago

I think MS now requires that you use that kind of card for the code signing certificate.

they also have regular EV certificates: https://shop.certum.eu/data-safety/code-signing-certificates.html?as_code_signing_rodzaj=5653

but those aren't cheap so I don't know if that's convenient

yorikvanhavre commented 1 year ago

Indeed this is more expensive than we thought... But it would still be doable if it is worth it, I guess that's what we need to look at I guess... I see as inconvenients:

And on the plus side:

adrianinsaval commented 1 year ago

EV certificates are instantaneous as I understood it, that's why they are so much more expensive. But I'm not sure if it's worth it, since eventually the warning also goes away for an unsigned executable. The non EV certificate is only worth buying if we are going to make several point releases within the year, after an initial release with that certificate all point releases with the same certificate should be trusted.

yorikvanhavre commented 1 year ago

Yes the more I think of it the more it seems like we're getting bullied into buying an expensive product, and that somehow "it will never be enough".

Let's leave this running and research more, though.

yorikvanhavre commented 1 year ago

Considering godaddy: https://www.godaddy.com/web-security/ev-ssl-certificate

yorikvanhavre commented 1 year ago

Bought today - paid via Paypal. Waiting on purchase confirmation and start of the validation process

yorikvanhavre commented 1 year ago

update - we had to provide a letter written by a lawyer ( #90 ) attesting that the FPA exists. This is now done and being analyzed by godaddy...