What is code signing?

What is code signing?

Code signing applies a digital signature to executables, installers, drivers, scripts, macros, mobile apps and container images. The publisher signs with the private key behind a code signing certificate, which comes from a public certificate authority for software distributed to others or from an internal CA for in-house tools. Anyone who runs the code can then confirm two things: which publisher signed it (authenticity) and that not one byte has changed since (integrity). A valid signature also supports non-repudiation, because only the key holder could have produced it.

What a signature cannot tell you is whether the code is benign. Malware signed with a stolen or misused key verifies just as cleanly as legitimate software.

How code signing works

1. The build system hashes the file, typically with SHA-256.
2. It signs the hash with the code signing private key and embeds the signature and certificate chain in the file. Windows uses the Authenticode format for this.
3. It has an RFC 3161 timestamp authority add a countersignature recording the date and time.
4. At install or run time, the operating system recomputes the hash, verifies the signature with the certificate's public key, and confirms the certificate leads back to a root it trusts, is valid for code signing and has not been revoked.

Code signing certificates have limited lifetimes, but signed software stays installed far longer. A trusted timestamp lets the signature keep validating after the certificate expires, because it shows the signing happened while the certificate was still in force.

Where signatures are enforced

• Windows: an elevation prompt for a signed installer names the verified publisher, while an unsigned one says Unknown publisher. 64-bit editions block unsigned kernel-mode drivers by default, and application control can trust software based on who signed it.
• PowerShell: the AllSigned execution policy runs only scripts signed by a trusted publisher, and RemoteSigned requires signatures on downloaded scripts. Microsoft describes execution policy as a safety feature, not a security boundary.
• macOS: Gatekeeper checks Developer ID signatures and notarization on downloaded apps.
• Mobile and containers: iOS and Android require signed apps, and deployment pipelines can refuse container images without a valid signature.

Example: signing and verifying a script

An admin signs a deployment script with a certificate from the company's internal CA:

$cert = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert

Set-AuthenticodeSignature -FilePath Deploy.ps1 -Certificate $cert -TimestampServer http://timestamp.example.com

Running Get-AuthenticodeSignature Deploy.ps1 afterward reports a status of Valid. If anyone edits even one character, the same command reports HashMismatch, and a machine set to AllSigned refuses to run the script.

Protecting the signing key

Anyone holding the private key can make malware look like the publisher's product. Stuxnet, discovered in 2010, loaded drivers signed with certificates stolen from Realtek and JMicron. In the 2020 SolarWinds compromise, attackers altered the vendor's build process, so the backdoored Orion update was signed with SolarWinds' genuine certificate. Since mid-2023, industry rules require the keys for publicly trusted code signing certificates to be created and kept in hardware, such as an HSM or a hardware token. Beyond that, sign only from the release pipeline, log every signing operation, keep test builds on a separate key and revoke quickly if a key leaks, setting the revocation date to the moment of compromise so releases timestamped before then still verify.

Code signing vs. hashes and HTTPS

A SHA-256 hash posted beside a download is only as trustworthy as the page that shows it, and the operating system cannot use it to identify the publisher. HTTPS protects the file while it downloads, not after it lands on disk. A code signature travels with the file and is checked automatically wherever the file runs.

Code signing on the CompTIA Security+ exam

Code signing is one of the application security controls in SY0-801 objective 4.1. Wording such as customers need assurance the installer is genuine and untampered, an unknown publisher warning or allow only signed scripts to run points to code signing. Distractors include a published hash, HTTPS on the download server, static code analysis and encryption, which provides confidentiality rather than proof of origin. A trap scenario describes a trusted, correctly signed update that turns out to be malicious: that points to a compromised build pipeline or stolen key, and the fix is protecting the build and signing process.