Security Certs on MacOS

Keep safe, my friend

Overview

Generate a signing key on CA website
Public Trusted CAs
Create CA root cert on Mac
Create self-signed cert on Mac
Export for running elsewhere
Sign a file on Mac
Resources
More on DevOps

This article describes the use of code-signing certificates on Macs.

For production use by the public, generate a code signing key on the website of a CA (trusted CA (Certificate Authority)) recognized in the operating system and application that uses your script/build.

You ship your script/program with the code-signing certificate generated for it.

The certificate is then imported onto the computer of those who which to use your script/program.

If your users need to reference a CA not already known to their internet browser, they also need to install a certificate to trust the CA in addition to the certificate the CA generated for you. This is the case for “self-signed” certificates and in organizations which have employees using a corporatew-owned CA.

Certificates generated for use on Macs may have a different format than those on Windows. But converters can be used.

Certificates are issued for a period of time, after which need to be renewed.

Generate a signing key on CA website

Select a CA and its reseller.

Public Trusted CAs

This reseller offers $69.17/year for a certificate from Comodo, which sells certs direct via InstantSSL at $179/year.

Alternately, Tucows offers certs at $75/year. VeriSign and GoDaddy (StarField) are two of the largest commercial root CAs. They charge $250 per year or more for certificates because they are the organizations behind Trusted root certificates in Apple’s OS X Trust Store and Microsoft.

A code-signing certificate is different than “SSL/TLS” certificates used by web browsers.

PROTIP: Even though a CA is not recognized by browsers, it doesn’t matter for code signing certificates created for PowerShell scripts, ActiveX controls, Java applets, dynamic link libraries, .cab files and .jar files.

CAcert.org offers certificates, but are not recognized. So they are equivalent to self-signed certs.

However, using them is less work than creating self-signed CAs and certs, described below.

A CA in Poland, certum.pl, used to offer free certificates.

CA StartSSL.com operates in Israel.

Certificates cost money because issuers confirm the validity of organizations they sign. This includes verifying physical existence and business presence.
Get a physical address for use on your domain, phone, utility, tax bill, bank, and drivers license.
Get a telephone bill under that address.

If you don’t want to use your cell phone, a http://www.magicjack.com/ account (at $40/year) will do.
Get a domain name with email setup under the same address on your driver’s license and utility bill.

Comodo does not allow use of free email accounts such as Gmail, Hotmail, etc.
Use Google Chrome to register for a Comodo account using that email address.

Comodo receives e-mail only from those with a support account.
Confirm the email, then return to the website for Password Login.
Get a bank checking account and printed check with the common physical address.

You may have to wait to receive your printed checks.
Scan into PDF files each proof of your identity.

You will be asked for a copy of identity papers shortly after you apply, so don’t pay for a cert until you have all the files you will need to present.

A property tax bill if you own your home.

A copy of the applicant’s Articles of Incorporation. Information in the Articles should be verified by checking the relevant government corporation database wherever possible. If it is not possible to at least verify the existence of a registered entity of that name in the relevant jurisdiction, then the Articles must be supplemented with additional documentation. Acceptable additional documentation: Business License DUNS details (e.g. Dun & Bradstreet company number).
Get a electric or phone utility bill under the address to be associated with the certificate.
Download and print Tucow’s face-to-face verification form.
Find and go to a Notary to confirm your ID and sign that verification form.

Most banks have a notary and will notarize free for their customers.
Pay for the certificate on the website.

Some CAs require you first create a CSR (Certificate Signing Request) file.
Upload PDF files to verify your identity.
Wait for a phone call from the CA.
Wait for the email with instructions to download the cert from their website.

You must use the same computer and web browser used to request the certificate.
Export the key from the browser
Backup the key immediately to alternate media such as CD or DVD disk.

PROTIP: USB plugs degrade over time quicker than CD or DVD disks.
Put the media in a fire-safe locked box.
Timestamp your signatures so the CA can “co-sign” your code such that even when your certificate has expired, Comodo continues to testify to your program’s legitimacy.

See http://wiki.cacert.org/TimeStamping

If the above is too much of a hassle for you, self-sign your app.

Create CA root cert on Mac

Create self-signed cert on Mac

Based on https://support.apple.com/kb/PH20131?locale=en_US&viewlocale=en_US

Click Apple’s search icon at the upper-right corner.
Type “Keychain Access” for that GUI.
Click “Keychain Access” and choose Certificate Assistant, then Create a Certificate.
Enter a name for the certificate in the “Create Your Certificate” GUI.

PROTIP: Include in the Name items separated by dashed: your email, machine name assigned by security, user name, such as “wilsonmar@gmail.com-M345-mac”.
Highlight the name and copy it to your Clipboard.
For Identity Type, leave it “Self Signed Root”.
For Certificate Type, select “Code Signing”.
Click Create and Continue for the pop-up.

NOTE: 2048 bits is the default (the minimum now). The program can generate up to 4096 bits.

See https://developer.apple.com/library/content/technotes/tn2326/_index.html
Click Create a certificate that’s good for one year.
Click Done.

Export for running elsewhere
Return to the “Keychain Access” GUI.
Click to select the certificate you just created.
Select menu File, Export Items.
Paste in Save As field the certificate name (“wilsonmar@gmail.com-M345-mac”).
Instead of “.p12” select “Certificate (.cer)”.
Click Save.
Quit Keychain Access.

Sign a file on Mac
Go to where you saved the cert created following the steps above.

Resources

https://www.sans.org/security-resources/glossary-of-terms/
Doug
http://www.wilsonmar.com/1certs.htm

More on DevOps

This is one of a series on DevOps:

Wilson Mar

Security Certs on MacOS

Generate a signing key on CA website

Public Trusted CAs

Create CA root cert on Mac

Create self-signed cert on Mac

Export for running elsewhere

Sign a file on Mac

Resources

More on DevOps

You might also enjoy (View all posts)