{"id":264,"date":"2022-08-30T11:03:09","date_gmt":"2022-08-30T11:03:09","guid":{"rendered":"https:\/\/signmycode.com\/blog\/?p=264"},"modified":"2024-09-18T13:04:54","modified_gmt":"2024-09-18T13:04:54","slug":"alert-ov-code-signing-is-changing","status":"publish","type":"post","link":"https:\/\/signmycode.com\/blog\/alert-ov-code-signing-is-changing","title":{"rendered":"OV Code Signing Certificate is Changing from June 1, 2023"},"content":{"rendered":"\n

Physical security tokens are going to be a must. Let’s understand why this is happening and what it means for everyone involved.<\/h2>\n\n\n\n

Cyber perpetrators don’t leave a single stone unturned when discovering security loopholes, no matter how thin their chances of success are. That’s why authorities such as CA\/B Forum must stay a step ahead, tighten their policies and minimize security breaches. <\/p>\n\n\n\n

One such change is occurring from June 1, 2023, related to OV Code Signing Certificates<\/em><\/strong>.<\/mark><\/p>\n\n\n\n

Lately, November 15, 2022 was the initial date for implementing the change in OV Code Signing Certificate issuance policies. But now CA\/B Forum has extended it for providing a relevant period for its seamless implementation.<\/p>\n\n\n\n

\n

From June 1, 2023, OV code signing certificates will require a hardware security module to store their private key. Moreover, this hardware must comply with FIPS 140 Level 2, Common Criteria EAL 4+ or equivalent.<\/p>\n<\/blockquote>\n\n\n\n

This change comes as the CA\/B Forum’s voted to change its “Baseline Requirements for the Issuance and Management of Publicly\u2010Trusted Code Signing Certificates.” Its latest version, 3.0.0<\/a>, outlines the changes coming to OV Code Signing Certificates.<\/p>\n\n\n\n

Before going into details of this change, let\u2019s first understand what OV code signing certificates are and how they function (for now).<\/p>\n\n\n\n

Effective from the mentioned date, any publisher reissuing, purchasing, or renewing a certificate will get restricted from exporting PKCS#12 or PFX files and using activation links without hardware tokens.<\/em><\/strong><\/p>\n\n\n\n

What is an OV Code Signing Certificate? How do They Work?<\/h2>\n\n\n\n

A Code Signing Certificate<\/a> authenticates executable scripts, code and content employing digital signatures. In other words, it assures users of the safety of the software or code they’re using.<\/p>\n\n\n\n

An organization validation OV Code Signing Certificate<\/a>, as the name implies, is a certificate that involves verification of the organization behind the software or code. Once signed, it displays the name of the publisher\/developer organization when users install it on their systems. This helps bridge the trust gap and communicates the software’s legitimacy to the end-users.<\/p>\n\n\n\n

Per current norms, once the certificate authority successfully verifies your organization, the certificate is stored in an encrypted file on the user’s computer. You don’t require any hardware token to store the certificate or private key<\/strong> until<\/span> 1st June, 2023.<\/p>\n\n\n\n

Here’s What Will Change After June 1, 2023<\/h2>\n\n\n\n

Here\u2019s what the Baseline Requirements for the Issuance and Management of Publicly\u2010Trusted Code Signing Certificates V 3.0.0 mentions:<\/p>\n\n\n\n

\n

Subscriber Private Keys for Code Signing Certificates SHALL be protected per the following requirements. The CA MUST obtain a contractual representation from the Subscriber that the Subscriber will use one of the following options to generate and protect their Code Signing Certificate Private Keys in a Hardware Crypto Module with a unit design form factor certified as conforming to at least FIPS 140\u20102 Level 2 or Common Criteria EAL 4+.<\/mark><\/em><\/p>\n<\/blockquote>\n\n\n\n

Thus, the private keys of OV code signing certificates must be stored in one of the following:<\/strong><\/p>\n\n\n\n