Skip to main content
MI Support IT logo

IT security

What is code signing?

Code signing proves who published a piece of software and that it has not been altered. See why the keys must live in hardware, and how timestamping works.

In short

Code signing is the digital signing of software, drivers and scripts, so the recipient can verify who published the code and that it has not been altered since it was signed.

Without a valid signature, Windows SmartScreen and macOS Gatekeeper show alarming warnings, and many environments block unsigned code entirely, so for software vendors code signing is in practice a requirement, not an option. The signing is done with a private key tied to a code signing certificate from a trusted certificate authority.

The key points are: since 2023 the CA/Browser Forum has required the keys to be protected in certified hardware such as an HSM, timestamping ensures that the signature remains valid after the certificate expires, and signing should be automated in the CI/CD pipeline with tight access control, because a leaked key lets attackers publish malware in your name.

MI Support IT has many years of specialist experience with PKI and helps Danish businesses with secure code signing from certificate to pipeline.

Back to the glossary

What is code signing?

Code signing is the digital signing of software: programs, installers, drivers, apps and scripts. The signature proves two things to the recipient, namely who published the code, and that not a single bit of it has changed since it was signed. Technically, it builds on a digital certificate issued by a trusted Certificate Authority, where the private key is used to sign a hash of the code. Operating systems and browsers enforce this bluntly: unsigned software triggers warnings from Windows SmartScreen and macOS Gatekeeper, and in many corporate environments it is blocked entirely.

How does code signing work?

The publisher computes a cryptographic hash of the software and signs it with their private key. The certificate containing the corresponding public key is packaged together with the signature. When a user installs the software, the operating system verifies both the signature and the certificate chain up to a trusted root. An important element is timestamping: an independent timestamping service confirms when the signing took place. This keeps the signature valid even after the certificate expires, because what matters is that the certificate was valid at the time of signing. Without a timestamp, all published software would have to be re-signed every time the certificate is renewed, and this ties in closely with the rest of the certificate lifecycle.

Why must the keys live in an HSM?

A code signing key is one of the most attractive targets for attackers: with it, they can publish malware that looks like it comes from you, valid signature and all. Several well-known supply chain attacks started precisely with stolen signing keys. That is why the CA/Browser Forum has required, since June 2023, that private keys for publicly trusted code signing certificates are generated and stored in certified hardware, that is, an HSM or an equivalent hardware device. The key can thus not be copied from a developer machine or a build server; it can only be used through the module. The Danish Centre for Cyber Security (CFCS) generally highlights protection of the software supply chain as a key focus area for Danish businesses.

Code signing in your development pipeline

In modern development, signing does not happen manually but as an automated step in the CI/CD pipeline: the build server sends the hash to a signing service, which performs the operation against the HSM and logs who signed what and when. That provides both speed and traceability, but requires tight access control, so a compromised build job cannot sign arbitrary code. Governance around signing belongs in your overall PKI, alongside TLS and email certificates. How to get the whole chain in place, from certificate choice through HSM to pipeline integration, is covered in our e-book PKI and HSM in practice.

How MI Support IT can help

We have many years of specialist experience with enterprise PKI and key protection and help you choose the right code signing certificates, meet the hardware requirements and integrate signing securely into your pipeline. Read more under PKI Management, or contact us for a no-obligation conversation.

Shall we talk about your business and your needs?

Real people talking to real people. We get back to you the same day.

Write to usBook a meeting