I know that SSL Certificates use a private key on the server side and the public key for verifying it on the client side. I am wondering, is it the same for Code Signing Certificates? Or do they just use a single Certificate, signed by the CA, that you use to sign your code with. Or do you sign it with a private key, and then when you ship it, the public certificate is also provided for verification of the signature. See the attached screenshot, this is the public key... but it has Code Signing ( 22.214.171.124.126.96.36.199.3 ) extension so was a little confused.
SSL Certificates use a private key on the server side and the public key for verifying it on the client side.
Certificates are data. They do not perform any action, thus do not use anything. And they do not contain a private key. They are public key certificates, and "public" applies to both the certificate and the key in the certificate.
A certificate is a collection of data elements:
- The public key that the certificate certifies.
- Other data elements (e.g. identifying the key holder, the purpose of the key, a validity period, the certification authority and the identification of it's certification key…).
- A signature binding the public key and (some or all of) said other data elements, verifiable against the certification public key.
Associated to the certificate, but not part of it, there is a private key, capable of making signatures that verify against the public key in the certificate.
To obtain a certificate, one typically:
- Generates a public/private key pair and securely store the private key; that can be in a security device (HSM, Smart Card) or in a file (perhaps password-encrypted).
- Generate and sign (using the private key) a Certificate Signing Request, and send that CSR to the Certification Authority. The CSR contains the public key, typically some of the above other data elements, and a signature of that made using the private key.
- Obtain the certificate from the Certification Authority, after some checks.
Is it the same for Code Signing Certificates?
Yes, the above applies to SSL server and code signing certificates alike. The difference lies in the purpose of the key as encoded in the certificate, and (somewhat correspondingly) the care used by the Certification Authority to check the identity of the key holder.
Do [code signing certificates] just use a single Certificate, signed by the CA, that you use to sign your code with ?
No. Signing a piece of code can't be performed with only a code signing certificate. Again a certificate is public; and ability to sign an executable using only public information would negate the goal of code signing.
Code signing is primarily performed with a private key. It's typically also needed the code signing certificate for the public key matching that private key, because that code signing certificate is typically included in the signed executable, for the convenience of the verification.