Securing Your Private Keys As Best Practice for Code Signing Certificates update from January 2013

Code signing is a technology that uses digital certificates and the public key infrastructure to sign program files so that users can authoritatively identify the publisher of the file and verify that the file hasn’t been tampered with or accidentally modified. As with other PKI technologies, the integrity of the system relies on publishers securing their private keys against outside access.

Companies that are diligent and willing to invest in the appropriate security measures can make the compromise of their private keys highly unlikely. Changes in developer processes may be necessary, but these should not impose serious inconvenience. 

This paper describes recent security breaches and why they may have happened. It also discusses best practices, especially for the Windows platform, which can help to safeguard the private keys associated with code signing certificates.