SSL certificate for HTTPs, activex signing and most mobile phone SDKs

Question

Hello, this is mostly a deployement than a programming question.

If I were to buy an SSL certificate from a CA, would I be able to use it to sign other applications (such as symbian, android, iphone ones)?

If so, what (re)seller would you recommend?

Answer 1

Server certificates (those that you'd use to enable HTTPS on a web server) are rarely enabled for code signing. I haven't looked at every CA in the world, and there probably are exceptions, but the more "legit" a CA is, the less likely they are to issue one certificate for both applications. In the end, I wouldn't expect to use the same certificate for both.

There is a better chance that a single code-signing certificate is accepted by most platforms. The developer documentation of each platform should list what CA certificates are built-in as trusted roots. In addition, most platforms will allow a user to view and modify the list.

Answer 2

You need to buy a certificate that is specifically authorized for code singing. In other words, the certificate must have the Extended Key Usage (EKU) for Code signing. Object ID (OID) for code signing can be found here: http://www.alvestrand.no/objectid/1.3.6.1.5.5.7.3.3.html.

Most commercial CA's should be able to tell you which of their certificates have this.

Answer 3

You need to get two different certificates. One to secure a server (https) and one to sign code. You can compare code signing certificates here: http://www.sslshopper.com/cheap-code-signing-certificates.html