Code Signing Inflation

I have been in a Windows software writing funk for the past year because my code signing certificate expired and during those happy three years of signing the industry changed beyond all recognition.

Code signing, or Authenticode, proves that my software came from me and hasn't been altered (as long as I'm not careless with my private key, and some alteration is possible). Windows is increasingly hysterical about running unsigned installers, and for good reason, so I have always signed anything I distribute widely.

For a long time I used K Software, who resold Comodo certificates (now Sectigo), and that cost me $70 a year with a 3 year certificate. K Software doesn't seem to exist any more, and Sectigo's list price is $715 / year. I'm not paying that to distribute free software. Part of the cost increase is that private keys either need to be on secure devices or hosted. Not a bad idea as compromised keys are an obvious disaster. There are some cheaper resellers but any palatable certificate cost seems to require a paid service for the actual signing.

When I last looked at this Microsoft had an interesting option on Azure (Artificat Signing) but it was only open to companies with three years of history, and so I gave up and worked on Android and web apps instead. This has now changed, and you can get an individual code signing service up and running for $10/month. I don't love it, but I'm willing to pay. There is a 'quick start' guide to get you up and running. I highly recommend pasting this into the LLM of your choice for a walkthrough, as it's a miserable process. I have got it going though and released a Catfood Earth update. Because it's a new certificate I'm starting from scratch on anti-virus reputation, unavoidable.

A few tips. Make sure your billing account for Azure is the name you want on the certificate first. Azure is a beast - full of things like progress for activating a service that ends up with it in an unactivated state until you refresh the page, or a mandatory selection on step 2 of a process that blocks you from completing step 1. I don't feel that this is a service they're excited to provide. Identity verification was online and fast which was pleasant (based on a drivers license for me). The person plan requires you to be in the US or Canada and supports up to 5,000 signatures a month.