{"id":587,"date":"2019-10-30T17:43:47","date_gmt":"2019-10-30T17:43:47","guid":{"rendered":"https:\/\/www.rapidsslonline.com\/ssl\/?p=587"},"modified":"2020-11-23T10:36:03","modified_gmt":"2020-11-23T10:36:03","slug":"free-code-signing-certificate-is-it-possible","status":"publish","type":"post","link":"https:\/\/www.rapidsslonline.com\/ssl\/free-code-signing-certificate-is-it-possible\/","title":{"rendered":"Free Code Signing Certificate \u2014 Is It Possible?"},"content":{"rendered":"\n

Some things in life are free\u2026 but code signing certificates aren’t among them<\/h2>\n\n\n\n

Everyone wants to get stuff for free: Free food, free entertainment (remember Napster?), and even free code signing. However, much like legitimate MP3s, code signing certificates<\/a> aren\u2019t free (at least, not trustworthy ones). And if anyone says that they can get you a free code signing certificate, run the other way. <\/p>\n\n\n\n

Simply put, a \u201cfree code signing certificate\u201d is an\nuntrusted \u2014 and untrustworthy \u2014 code signing certificate. It\u2019s something that\nevery reputable software developer or publisher should avoid. Here\u2019s why.<\/p>\n\n\n\n

Why Can\u2019t I Get a Code Signing Certificate for Free?<\/h2>\n\n\n\n

But why isn\u2019t there free code signing? After all, there are\nfree SSL certificates, right? True. There are free DV SSL certificates that\nsome organizations issue \u2014 but that doesn\u2019t mean they\u2019re necessarily a great\nthing. <\/p>\n\n\n\n

\u201cFree\u201d SSL certificates aren\u2019t truly free because they make you pay in other ways (shorter lifespans, certificate management headaches, lack of support, lack of site identity, etc.). Also, they require only the most basic level of validation \u2014 domain validation<\/a> (DV). This process entails binding a public\/private key pair to your website to transfer data via the secure HTTPS protocol without asserting any real identity or trust. <\/p>\n\n\n\n

Asserting trust and identity requires organization validation (OV) or extended validation (EV) capabilities. With code signing, there is no DV-equivalent. And considering that more than half of phishing websites use free SSL certificates<\/a> \u2014 free DV SSL certificates \u2014 it isn\u2019t exactly the kind of example that you want to point to when supporting the idea of why something should be free.<\/p>\n\n\n\n

Getting into the Nitty-Gritty of Why Free Code Signing Doesn\u2019t Exist<\/h2>\n\n\n\n

When it comes to the issue of free code signing and why it\u2019s\nnot possible, it really boils down to compliance, reputation, and economic\nconsiderations. Getting your software signed and trusted by a certificate\nauthority (CA) is a very powerful thing. If a trusted CA signs off on your\nsoftware, then the major browsers will trust your software. This means that\nsecurity systems like Microsoft\u2019s SmartScreen filter won\u2019t kick up a warning\nthat informs users about the potential dangers of untrusted software.<\/p>\n\n\n\n

As a certain superhero\u2019s late uncle liked to say: With great\npower comes great responsibility.<\/p>\n\n\n\n

Secure Your Software with DigiCert Code Signing<\/h2>\n

Add digital code signing security on your software with world’s trusted code signing certificate.<\/p>\n

Shop DigiCert Code Signing<\/a><\/p>\n<\/div>\n\n\n\n

For a CA to have this kind of power, they need to meet certain\nsocial and technical trust criteria and expectations. This is where CA\u2019s root\ncertificates and certificate trust chains come into play. But the SSL\ncertificate chain<\/a> is a whole other technical conversation for another time\n\u2014 thankfully, one we\u2019ve already covered in a previous article. <\/p>\n\n\n\n

To get back to the point: If just anyone<\/em> could get a\ncode signing certificate without any sort of vetting, imagine the chaos it\nwould create. Not to mention the reputational damage it would create for the\nCAs. To avoid issues of certificate abuse and key mismanagement \u2014 and to create\nbarriers for keeping bad people from getting code signing certificates \u2014 that\u2019s\nwhy there needs to be a certain level of vetting involved for a certificate to\nbe issued. <\/p>\n\n\n\n

But, like many things in life, basic and extended business\nvetting isn\u2019t free. CAs, the organizations that are responsible for issuing\ncode signing certificates, can\u2019t just hand out free code signing certificates. After\nall, they want to make sure that not only your company\u2019s legit but that they also\nhave a \u201cCYA\u201d paper trail to protect them (you know, just in case you decide to\ngo to engage in shady business later). <\/p>\n\n\n\n

As you can imagine, there are costs involved with vetting\nyour company before they issue any code signing certificates. These costs\ninclude:<\/p>\n\n\n\n