构建服务器上的安全验证码密钥
我正在尝试找出如何最好地在我的工作场所设置 Authenticode 签名。安全隐患让我压力很大。
我最初的想法是，控制密钥的人应该将其安装到构建服务器并保护它，以便只有构建帐户可以访问它。
这看起来相当安全，但实际上并非如此。是的，此时您无法窃取证书，但如果您可以创建构建，则可以使用构建帐户来签署任何二进制文件。
有熟悉流程的人给我指点一下吗？
I'm trying to figure out how best to set up Authenticode signing at my workplace. The security implications are stressing me out.
My initial thought is that the person who controls the key should install it to the build server and secure it so that only the build account can access it.
This seems reasonably secure, but it actually isn't. Yes, you can't steal the cert at this point, but if you can create a build you can get the build account to sign any binary.
Does anyone who is familiar with the process give me some pointers?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
事实上，如果密钥可用于构建帐户，则它也可用于管理员帐户，并且可用于签署其他文件。无论你给予别人的财产，都不再是你的了。如果您无法保护服务器免遭其他人访问，那么您就无法完全控制服务器，从而有可能被滥用。坦率地说，我无法想象有一种方法（除了将签名转移到其他受信任的系统之外）来保护密钥免遭滥用。即使密钥无法提取或复制（例如将其放入加密令牌中），它仍然可以以某种方式使用。
Indeed, if the key is available for use in build account, it's available for admin's account and it can be used to sign other file. Whatever you give to others' posession is not yours anymore. If you can't secure the server from other people access, then you don't control the server fully, and this leaves a chance for misuse. Frankly speaking, I can't imagine a single way (other than move signing to some other trusted system) to protect the key from misuse. Even when the key can't be extracted or copied (say it's put to cryptotoken), it still can be used in some way.