5

I have developed an application which I intend to sell. I set up a website with information and download links, advertising, payments, everything is ready to go - except the digital signature. I want to sign my application so that Windows and various antiviruses won't nag my customers about an unsigned, unverified application.

I know that getting a CA certificate is not free, and certainly not cheap, but the biggest problem isn't the price - it's that every CA vendor requires one to have a registered company or business, which I don't. Registering and maintaining a business, even in the most lightweight form of it is an extremely expensive, lengthy, and paperwork-heavy ordeal. I have consulted with lawyers from my country, and they all confirmed the same - just not worth it in my scenario.

My question is - since I cannot afford to establish a business (not at this point, nor anytime in the foreseeable future), how can I purchase a CA certificate? Is there a vendor who issues these to private individuals? Is there any alternative way I can prove that I am a trustworthy programmer? How do small-time software makers and sellers usually deal with this issue? All I want is for my customers to never have the inconvenience of having to white-list my application in their antiviruses, or get the annoying warning from Windows that the application is unverified.

Justinas Rubinovas
  • 69
  • 2
  • If you can't afford to setup a corporation or LLC/etc, then you definitely can't afford to field the liability of a commercial Enterprise. – whatsisname Sep 28 '18 at 00:51
  • 2
    That is true, sir. As I said in my post, I am not trying to set up a corporation or an enterprise; I am just trying to make a small profit from the application I created, and reduce the inconvenience for my potential customers. Do you know how can I do that? – Justinas Rubinovas Sep 28 '18 at 01:01
  • You don't say where you are, but if its too expensive to set a business up in your country, would it be possible to set one up somewhere else? I've gone through this many times, and it is a headache, but in the US its not too difficult to file a DBA or LLC in most places for minimal cost. The bigger problem I've had is finding what directories they want to see your listings in, because it changes each time I renew certs. – GrandmasterB Sep 28 '18 at 17:01
  • I'm from Lithuania (it's in Eastern Europe). Registering a business here is a nightmare. I'm talking about thousands of euros, a ton of paperwork, and so many taxations, that it would easily turn my profits into losses. Setting it up in another country... I suppose that's possible, but also very difficult, because it's in another country. How do freeware/open source developers deal with this issue? I have seen thousands of small apps around the internet, made by amateurs, who most certainly don't own any company, and yet, nor Windows, nor antiviruses ever nagged me about using those apps. – Justinas Rubinovas Sep 28 '18 at 17:11

1 Answers1

1

To answer the question "How can I obtain a CA certificate for my application if I do not own a business/company?": at least some CAs issue certificates for individuals. For example Comodo says

"The organization validated certificate is a good option for companies or individual that do not meet the standards required to obtain the extended validation certificate. For example, an individual selling merchandise online that is not a corporation or other recognized entity can use the OV SSL and provide a higher level of security for customers than the DV."

(Source: https://ssl.comodo.com/articles/the-ssl-certificate-domain-validated-organizational-validated-or-extended-validated.php)

You say that "I want to sign my application so that Windows and various antiviruses won't nag my customers about an unsigned, unverified application."

When distributing your app outside of Microsoft's store it seems like you need to sign it with a certificate, as you said. See also https://stackoverflow.com/questions/252226/signing-a-windows-exe-file

Alternative

If it would be enough to distribute the app through Windows store, you wouldn't need a certificate, according to Microsoft:

"You must digitally sign your Windows Store apps before you deploy them. If you don't use Microsoft Visual Studio 2012 to create and sign your app packages, you need to create and manage your own code signing certificates. You can create certificates by using MakeCert.exe and Pvk2Pfx.exe from the Windows Driver Kit (WDK). Then you can use the certificates to sign the app packages, so they can be deployed locally for testing."

Also a as correct accepted Stackoverflow answer indicates the same:

"You don't need to use a valid certificate to publish your app to the Store. You just need to sign it with a test certificate. When you upload it to dev. center, it will be signed by Microsoft to be distributed through the Store."

simon
  • 187
  • 5
  • Thank you very much for your answer. I do not plan to sell my application on Windows Store, but instead through my website. Does the self-signing still apply? I was under impression that self-signing only works for the computer that the application was signed on, and will not help those who will be running the application on other computers. Isn't that right? – Justinas Rubinovas Sep 28 '18 at 16:32
  • Sorry for the confusion, self-signing seems to apply only when you distribute your app through the Windows store. I updated the answer accordingly. – simon Sep 28 '18 at 17:09
  • Thank you, simon. I have followed these suggestions, created a certificate, and signed my application with it. It shows up on the Properties of the .exe. My computer stopped nagging me about it, and the antivirus seems to be happy too. But I'm not sure if that would work for other people as well. If it's not too much to ask, maybe you could download my .exe and try to run it? It's 1.6 MB, no installation required. I would certainly appreciate it. Whether you have time for it or not, thank you very much for your help so far. https://drive.google.com/file/d/1ukqhLLBtGYgMT-gvsv8YrP5cJt654Xoq/view – Justinas Rubinovas Sep 28 '18 at 17:16