Windows Mobile 应用程序代码签名 - 建议？
我的任务是获取代码签名证书。 我们的应用程序实际上由 2 个互补的组件组成：一个桌面应用程序和一个设计用于在 PDA 上运行的 Windows Mobile 应用程序。 目前，我们的移动安装（通过 CAB 文件）会触发 Windows Mobile 6 中的安全提示，这让我们的用户感到困惑。 我们希望消除这些安全警告。
找到对桌面应用程序进行签名的证书似乎很容易（我们也需要它），但我不太清楚这样的代码签名证书是否可以解决我们的 Windows Mobile 问题。 我理想的解决方案是 1 个可以对桌面和移动应用程序进行签名的证书。
我读了很多关于移动应用程序签名的内容，这些内容围绕 Mobile2Market 和疯狂的多步骤签名程序 - 甚至发送您的可执行文件以进行签名和返回。 我认为这主要针对手机市场，手机提供商已严格锁定手机，禁止使用未签名的应用程序。
我们的设备主要是预先配置了一层安全性的 Windows Mobile 6 PDA (iPAQ 210)。 我们不想配置设备、安装证书等（除非绝对必要）。 我们只想签署文件然后忘记它。
有没有人做过类似的事情并有什么建议？ 我对低成本解决方案特别感兴趣，这些解决方案不需要向 Verisign 支付大量资金——也许是 Comodo 之类的。
I'm tasked with obtaining a code signing certificate. Our application actually consists of 2 complementary components: a desktop application and a Windows Mobile application designed to run on PDAs. Currently our mobile install (via CAB file) triggers the security prompts in Windows Mobile 6 and it is confusing to our users. We want to eliminate those security warnings.
It seems easy enough to find certificates to sign a desktop application -- which we also need -- but I'm less clear about whether or not such a code signing certificate will fix our Windows Mobile problems. My ideal solution is 1 certificate that can sign both the desktop and mobile apps.
So much I read about mobile app signing revolves around Mobile2Market and crazy multi-step signing procedures -- even sending your executables in to have them signed and returned. I think this is mainly aimed at the mobile phone market, where cellular providers have tightly locked down the phones against non-signed apps.
Our devices are primarily Windows Mobile 6 PDAs (iPAQ 210) that come pre-configured with One Tier security. We don't want to provision devices, install a certificate, etc (unless absolutely necessary). We just want to sign the files and forget about it.
Has anyone done something similar and have any recommendations? I'm especially interested in lower-cost solutions that don't involve paying lots of money to Verisign -- something like Comodo perhaps.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您可以对二进制文件进行自签名，但最终用户必须将您的证书安装到设备商店中，这可能会比仅获得真正的签名更痛苦，并且支持成本也更高。
您需要的是购买 M2M来自 Verisign 的证书。 他们会向您发送一个包含某种密钥材料的 USB 密钥，您将使用它和他们的应用程序来签署您的二进制文件。
此处概述了什么级别的安全性会给出什么提示。
You can self-sign the binaries, but the end user will have to install your certificate into the device store, and that is probably going to be more painful, and more expensive in support costs than to just get a real signature.
What you need is to purcahse a M2M certificate from Verisign. They will send you a USB key that contains some sort of key material, and you will use it and their application to sign your binary.
What level of security gives what prompts is outlined here.