Code Access Security - Implementing Publishers Based Security Using Digital Certificates

With upcoming usage of Internet, distributing the software over the Internet is very common now. Assemblies/Components are deployed across wide network. If you the software company and want to distribute code through Internet, you can build an assembly and sign that assembly with digital certificate. Digital certificate provide the information about software publisher, consumer of the software can verify the identity of the software publisher. Security administrator can grant the permission to particular publisher in order to the run assemblies signed by that publisher.

In the commercial environment, we would obtain a certificate form a company such as varisign. The benefit of purchasing a certificate from the supplier rather than creating your own is that they provide high level of trust in authentication. For the testing purpose .Net provides you command line utilities to create and test digital certificates. This gives the picture how we can use digital certificates with .net application

MakeCert generates X.509 certificates for testing purposes only. It creates a public and private key pair for digital signatures and stores it in a certificate file. This tool also associates the key pair with a specified publisher's name and creates an X.509 certificate that binds a user-specified name to the public part of the key pair.

Open Visual Studio command prompt and type following command as shown in following figure This command creates a test certificate and writes it to AnandThakur.cer.

The Software Publisher Certificate Test tool creates a Software Publisher's Certificate (SPC) from X.509 certificates. Cert2spc.exe is for test purposes only.

To Create Software Publisher Certificate, type following command in Visual Studio command prompt and as shown in following figure

The File Signing tool signs a portable executable (PE) file (.dll or .exe file) with an Authenticode digital signature. You can sign either an assembly or an individual file contained in a multi file assembly. If you are distributing an assembly, you should sign the assembly rather than the individual files

To run the File Signing tool, type SignCode.exe in VS command prompt. It will launch a wizard.

Enter the name of the .exe/.dll file you want to sign with certificates and click on next. In next screen select custom and press next. In signature certificate screen, click on "Select from file" and select .spc file(in this case AnandThakur.spc) you have created using Cert2spc.exe.

In private key screen, select "private key on disk" and enter the path to private key created earlier using MakeCert.exe (in this sign.pvk), In next screen choose Sha1 and click next.