I have been using FreePascal (and before that Delphi) for many years and it has worked fine. I am now retired and only perform maintenance work.

And now I am getting a request for "signing" the applications (and/or possibly the installers made by InnoSetup) and I have no idea on how to do this.

Apparently some customers cannot install the software because of IT department policies prohibiting running unsigned programs...

What to do about this? Most involved products are for Windows and they are 32 bit.

Several of the applications are quite old with last compile date back around 2012-2016...

Is there a how-to for FreePascal and Delphi that outlines how to do it?

The process should be possible to be applied to already existing exe files because the builds can no longer be performed since the original dev environments no longer exist.

TIA

Basically you need the Windows SDK. It comes with a program called signtool.exe that can sign things. Lots of examples here: https://learn.microsoft.com/en-us/dotnet/framework/tools/signtool-exe

It's fairly straight-forward to use this on executables. You point it at the EXE and the code signing certificate you will use.

For InnoSetup it needs to be rebuilt since you also need to sign the uninstaller that it creates. Info here
https://jrsoftware.org/ishelp/index.php?topic=setup_signtool

Best Regards,
Jeppe

El 10/8/24 a les 11:28, Jeppe Johansen via fpc-pascal ha escrit:

It's fairly straight-forward to use this on executables. You point it at the EXE and the code signing certificate you will use.

I guess you'll have to get ($$$) a valid signing certificate too.

Bye

Can I use LetsEncrypt certificates or must I cash out big to get a working one?

El 10/8/24 a les 15:32, Bo Berglund via fpc-pascal ha escrit:

I'm not sure but I fear the latter.

Bye

I haven't tested yet for windows executables,

but recently for Android I had to sign an apk made with Lazarus for Android Module Wizard,

you just need a free certificate created with Android Studio .

May be for Windows a certificate created with Puttygen is sufficient ?

I have been using signtool for a number of years for apps built with Delphi and/or FPC.

The question of whether you need a expensive CA based certification will depend on your IT department.

Any certificate from any certification authority will work to sign an app, but it needs to be trusted by Windows for it to be used. Microsoft include a number of CA root certificates in the Windows distribution/updates, which may vary between Windows version.

Use MMC, add/remove snapin, and select Certificates for the Local Computer. You can then see the supported root and intermediate certificates on your computer.

Your IT department can add another CA root certificate by using group policy. This will also be push it to all computers on the network.

https://docs.omnissa.com/bundle/Horizon8InstallUpgrade/page/AddtheRootCertificatetoTrustedRootCertificationAuthorities.html

Derek

On Sun, 11 Aug 2024, 1:33 am Bo Berglund via fpc-pascal, <

I couldn't manage to create a pfx from PuttyGen or from openssl.

Following Derek Edson's advice, I went into mmc and could see that a certificate was already created in my name.

In start menu, I opened under menu Visual Studio 2019 the shortcut Developer PowerShell for VS 2019 and typed on the command line:

signtool sign /a /fd SHA256  path_to_my_executable

and it choosed automatically my certificate to sign the executable. Then it seems that you can add this certificate to Windows trusted certificates.

And now I am getting a request for "signing" the applications (and/or possibly the installers made by InnoSetup) and I have no idea on how to do this.

Signing an FPC application can be done completely independent of FPC/Lazarus applying singntool (from Windows SDK) to compiled binary.

InnoSetup has support for singing, it also can sign uninstaller executable.

Apparently some customers cannot install the software because of IT department policies prohibiting running unsigned programs...

In addition they have to trust your certificate used for signing.

Technically you can sign using an selfsigned certificate. But "IT-Department" has to add that to trustlist.

Presumably you have to by an codesign certificate

What to do about this? Most involved products are for Windows and they are 32 bit.

There is no difference in signing 32 or 64 Bit.

The process should be possible to be applied to already existing exe files because the builds can no longer be performed since the original dev environments no longer exist.

You should exclude FreePascal / Delphi from your search - just look for signing win32 application.

Elmar

Hi,

I had the same problem and still have. Some of my customers require a trusted certificate from a well known CA. I called many Cas, but did not get a certificate. The reason is: I am a single entrepreneur running an engineering office – not a registered company. Certificates are not issued to private persons. Otherwise every bad guy could also get one.

Best regards,

Wolfgang

Bad guys may have some loosely registered business. That argument is ridiculous. And really bad guys get their certificates at places where no documents are required.

Take a look at:

https://support.certum.eu/en/code-signing-required-documents/

Al least the "standard code signing" does explicitly mention individuals. Ask their support what documents are required for EV certificate.

Hint: at https://www.sslmentor.de/ssl/code-signing there are lower rates for the same certificates.