Before you can sign an FDI Package, you need the following:
1. Valid Code Signing Certificate
2. Intermediate certificates
3. Address of RFC 3191 trusted time stamp server
4. Up-to-date Root Certificates (Microsoft Store)
5. FDI Package Signing tool
Items 1 through 3 are provided by the certification authority. Item 4 is obtained from Microsoft, see our support article: Install Root Certificates. Item 5 is provide in the FDI Package IDE installation.
Getting a code signing certificate
Before you can sign an FDI Package with a code signing certificate, you must obtain a code signing certificate from a certification authority that is trusted by Microsoft Windows under Microsoft's Trusted Root Certificate Program. Look for a code signing certificates supporting "Microsoft Authenticode." Both Code Signing and EV Code Signing certificates are valid for use with FDI. Code signing certificates are provided with validity periods (e.g. 1 year, 2 year , 3 year). This validity period defines how long the certificate can be used for signing. Each code signing certificate has a Common Name attribute that will be shown to the end user that imports the FDI Package. For example, the common name for FieldComm Group's EV code signing certificate is "FieldComm Group, Inc."
Example EV code signing certificate with private key indication
When you obtain the code signing certificate, the private key will be installed on your computer, or for EV code signing, installed on specialized devices such as a USB hardware token. It is important that you have access to the private key (or usb hardware token) on the same machine as the tool used to sign the FDI Package. There is typically a password assigned to the private key/hardware token that is required before you can use the certificate to sign an FDI Package. Hardware tokens typically require a software driver/application to support them. (e.g. SafeNet) Your certification authority may provide this software.
Refer to the documentation provided by the certification authority for additional help on installing the code signing certificate.
Your code signing certificate's signature algorithm should be using a SHA256 algorithm for best encryption. The SHA256 algorithm is highly recommended over SHA1. The signature hash algorithm can be SHA1. Refer to https://csrc.nist.gov/projects/hash-functions/nist-policy-on-hash-functions
In addition to the code signing certificate, you will also need any intermediate certificates that are provided by the certification authority. Typically, code signing certificates are not issued by the "root" certificate authority but by an intermediate.
Certification path shows root, intermediate and code signing certificates.
Therefore, for the consuming FDI host to establish the trust from your code signing certificate to the root store, you need to provide intermediate certificate(s) between your certificate and the trusted root certificate. Your certificate authority will provide any intermediate certificate(s).
The tool allows you to include these certificates. These certificates need to be provided in base64 format. There may be more than one intermediate certificate. If you open the certificate with a text editor and see "-----BEGIN CERTIFICATE-----" line, then your certificate more than likely is in the correct format. If you have multiple intermediate certificates, simply create one PEM file with all certificates listed. Order does not matter. Do not include the root nor your certificate, only intermediates.
Example of a PEM file with 2 intermediate certificates
HINT: Use can also use the Certificate Export Wizard to export the intermediate from your machine to a file. (Select "Copy to File..." on the details tab of the selected certificate)
HINT: If you change the extension of the intermediate certificates file to .CER (e.g. intermeidate.cer), windows provides native means to view the certificate. This is a good way to confirm the proper certificate. The FDI signing tool requires a file with .PEM extension.
Trusted Time Stamp Server
Code signing certificates have a validity period. The trusted time stamp server is used to prove that the package was signed within the validity period. The certification authority will provide a link to a RFC3191 time stamp server.
Signing an FDI Package
With all prerequisite met, you can now sign the FDI Package. Launch the signing application.
1. Provide location to the FDI Package to sign
2. Select the certificate used to sign. You may have multiple certificates that can be used to sign. Make sure you select the correct one.
3. Enter the url for the trusted time stamp. The are typically http and NOT https urls.
4. Finally, provide a link to the file containing intermediate certificate(s).
5. If you are behind a proxy, update those settings as appropriate.
The signing tool needs to connect to the trusted time stamp server to obtain the counter signature. This can take several seconds.
If you do not have a code signing certificate yet, you can still create a self signed certificate for testing purposes only. You will be able to sign FDI Packages, however this package should not be released because the consuming FDI host will not trust it.
For information on creating a self-signed certificate for testing: https://docs.microsoft.com/en-us/powershell/module/pkiclient/new-selfsignedcertificate