To the other developers here, what are you doing for code signing certificates these days?
We used to buy one that lasted for 3 years, but that one is expiring next week and it has been a nightmare getting a new one.
The new certificates require a secure key/token, but the YubiKey FIPS doesn’t support RSA3072 for Windows signing and the other Gemalto key doesn’t support remote attestation, which means I would need to courier the key back-and-forth once a year or buy a new one every year (since certificates have a maximum validity of 1 year starting this week).
The only local guys I see that does this is SmartWeb for about R10k per year.
I guess it’s only really relevant to desktop software. I haven’t touched development of desktop apps in 10 or so years, so I’m quite out of the loop regarding code signing.
Ok, so an update for anyone interested or coming across this thread in the future.
I bought a 10 year code signing certificate from ssl.com at what works out to about a quarter per year than other providers, but with code signing certificates now expiring every year, they wanted to sell me a new Gemalto key for $280 every year and ship the renewed certificate to me.
I finally contacted Yubikey and they confirmed that they’ll release a new FIPS compliant Yubikey that supports RSA3072 on PIV and remote attestation somewhere in the next 3 months. So I guess I’ll just sit without a certificate until then, buy that when it releases and load the certificate remotely every year. That Yubikey should be around $100 in price and it will be once-off.