🥇 New private key storage requirement for all Code Signing certificates - June 2023 (Update) - SSLPOINT

New private key storage requirement for all Code Signing certificates – June 2023 (Update)

Description

Starting June 1st, 2023 at 00:00 UTC, all private keys for standard code signing certificates must be stored on hardware that is certified as FIPS 140 Level 2, Common Criteria EAL 4+, or equivalent. This change strengthens private key protection for code signing certificates and aligns it with the security standards for EV (Extended Validation) code signing certificates.

New Requirements for Standard Code Signing

The new private storage key requirement will affect code signing certificates issued from June 1st, 2023 onwards, and will have impact on the following parts of your signing process:

* Private key storage and certificate installation
* Signing code
* Ordering and renewing certificates
* Reissuing certificates
Since it is mandatory to store the key on a token, it is also no longer possible to export the certificate and the private key in PFX file format.

Ordering and renewing code signing certificates

This new requirement means that Certificate Authorities (CAs) will no longer be able to support browser-based key generation and certificate installation, or any other process that includes creating a CSR (Certificate Signing Request) and installing your certificate on a laptop or server.

Reissuing certificates after June 1st, 2023

When you reissue a code signing certificate, the certificate must be installed on a supported hardware token or HSM. If necessary, a hardware token must be ordered from the Certificate Authority for a fee.

SimplySign as an alternative to hardware tokens

SSLPOINT has teamed up with Certum, Europe’s top Certificate Authority, to offer you the “Code Signing SimplySign” product line. This software-based solution securely stores the private key in a virtual vault, meeting industry standards without the need for extra hardware tokens.

Certum “Code Signing SimplySign” offers an attractive pricing model, excellent support and rapid issuance as additional features.
You can order Certum “Code Signing SimplySign” certificates here: Certum Code Signing Certificates
Reference:
CAB Ballot CSC-13: Update to Subscriber Key Protection Requirements
CAB Ballot CSC-17: Subscriber Private Key Extension