1

this sounds like a duplicate question but still I couldn't find a correct solution. Maybe a lack of knowledge in this domain.

Anyway, I am using the EV code signing certificate along with a USB device from the COMODO provider, working fine.

But just to make the CI process smooth we wanted to get rid of the USB device and use cloud HSM. Did many calls with all most all vendors but was not clear cost-wise and solution wise which provider to choose from. At the end, I want to import my existing certificate and sign files.

Please share some pointets

Abhishek Sharma
  • 23
  • 4

2 Answers2

0

But just to make the CI process smooth we wanted to get rid of the USB device and use cloud HSM.

The code signing certificate is stored on an external hardware token (USB key). You will not be able to import the private key into an HSM.

Using AWS CloudHSM will not allow you to bypass Comodo's code signing certificate procedures (usage or renewal). Since the Comodo EV certificate implements Two-Factor Authentication (PIN), you must use their procedures which means the hardware token must be present to sign.

Unless you require that level of key security, consider a standard Code Signing certificate.

John Hanley
  • 74,467
  • 6
  • 95
  • 159
  • Thanks, @john-hanley, so is this a limitation from Comodo that they don't allow us to import the certs, or if even I moved to DigiCert's I will face the same issue? Just gathering a little info before I try for standard code signing certs. – Abhishek Sharma Apr 21 '22 at 06:20
  • It is not a limitation, it is a design feature for security. The private key is on a hardware token. – John Hanley Apr 21 '22 at 07:45
  • How About DigiCert? Do they have the same design or I can import their certifications? Or am I asking the wrong question? – Abhishek Sharma Apr 21 '22 at 08:00
  • @AbhishekSharma - I have not worked with DigiCert for a few years. I do not know what they offer today. Remember, for new questions, create a new post. – John Hanley Apr 21 '22 at 08:10
0

Disclaimer: I haven't actually done this, just been researching it for our own use.

There seem to be two ways to do this:

  1. Generate your CSR with non-exportable key in the HSM in some way that can be verified by the certificate issuer. The CA then issues your certificate to be imported in the HSM. This varies by cloud HSM provider. SSL.com can do this and outlines the mechanism here https://www.ssl.com/guide/supported-cloud-hsms-document-signing-ev-code-signing/

  2. Use cloud signing as a service. The service issues the certificate and keeps it and the private key in their HSM. This might be more cost-effective too because cloud HSM's are wicked expensive. You generate a hash of your file, send it (and some strong authentication like OTP) to the service, they send back a signature. Again SSL.com has a service called eSigner which they document well (including how to use the TOTP secret for build automation so you don't need to manually use your OTP app each time). I think DigiCert's "Secure Software Manager" is a similar service but I haven't verified that yet, their documentation is really high-level and vague.

efhard
  • 1