Skip to content

Commit 9bed8e6

Browse files
4lb4lb
committed
certum blogpost
1 parent 5b7663d commit 9bed8e6

File tree

3 files changed

+154
-4
lines changed

3 files changed

+154
-4
lines changed

‎astro.config.mjs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ export default defineConfig({
5656
}],
5757
],
5858
shikiConfig: {
59-
theme: 'github-dark',
59+
theme: 'github-light',
6060
wrap: true
6161
},
6262
},

‎src/content/blog/windows-codesign-certum-hsm.mdx

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
---
2+
title: Secure Tauri/Windows Code Signing with Certum HSM
3+
publishDate: 2024-05-07
4+
description: One of our products — Defguard & WireGuard Desktop Client has multiple platform releases (Linux, MacOS, and Windows). We're building it with our beloved Rust and a great multi-platform desktop framework Tauri.
5+
author: "Robert Olejnik"
6+
---
7+
8+
![](/images/blog/defguard-main-screen.png)
9+
10+
[Defguard & WireGuard desktop client](https://defguard.net/client/)
11+
12+
While doing releases with [Tauri](https://tauri.app/) is pretty straightforward and well-documented, the [Code Signing for MacOS is](https://tauri.app/v1/guides/distribution/sign-macos) spot-on, but the [Windows Code Signing](https://tauri.app/v1/guides/distribution/sign-windows) is not that straightforward. Tauri documentation assumes you have a certificate file (pfx - with certificate & key) - but **most (if not all) Code Signing Certificates are sold on dedicated HSMs (Hardware Security Modules) that must be FIPS 140-2 compliant.**
13+
14+
Thus to handle signing:
15+
16+
1. One has to have a **self-hosted GitLab/Github Runner** - which just physically can have the HSM connected to the USB (and of course the runner needs to be in a secure network location and well as the system needs to be secured).
17+
2. There needs to be a solution & tools to handle this process automatically during the build & release.
18+
19+
Most certificate authorities have a dedicated solution for that ([DigiCert](https://www.digicert.com/solutions/security-solutions-for-ci-cd), [Sectigo](https://www.sectigo.com/enterprise-solutions/certificate-manager/devops-solutions)) or solutions, examples, and a great documentation ([SSL.com](https://www.ssl.com/guide/code-signing-automation/)) but we have chosen [Certum Code Signing](https://www.certum.eu/en/code-signing-certificates/) certificate for two reasons, they operate as us in Szczecin Poland and they have a great [Open Source Code Signing](https://shop.certum.eu/open-source-code-signing.html) product - and [defguard](http://github.com/defGuard/defguard) is an open-source project. The downside is that **they do not have any CI/CD documentation or solutions**, and weirdly (everything should be on the internet, right?) there are no docs, solutions, snippets, projects, or blogs (you name it), that could help us set up this process.
20+
21+
So after weeks of going back and forward with the Certum support and going nowhere (greeting for our colleagues), we took this project on our shoulders - and here are the recipes for building a Debian GNU/Linux CI/CD runner.
22+
23+
We assume you have:
24+
25+
1. a configured GitHub/GitLab self-hosted runner based on Debian GNU/Linux (but Ubuntu should work as well)
26+
2. Bought an [Open Source Code Signing Certificate set from Certum](https://shop.certum.eu/open-source-code-signing.html)
27+
3. Have the certificate issued and the key is on the HSM shipped by Certum and it's connected to the runner.
28+
4. You also have downloaded the certificate file in PEM format (from certum website), and placed it in /srv/codesign/certum/certificate.pem
29+
30+
Now we need to prepare the runner system to support the HSM. First let's install all necessary system software:
31+
32+
```bash
33+
apt install opensc opensc-pkcs11 libpcsclite-dev pcscd libacsccid1 \
34+
libengine-pkcs11-openssl osslsigncode
35+
```
36+
37+
Now, we need to install the Linux version of [proCertumCardManager](https://support.certum.eu/en/cert-offer-card-manager/) provided by Certum:
38+
39+
```bash
40+
mkdir /srv/codesign/
41+
cd /srv/codesign/
42+
43+
# We download proCertumCardManager
44+
wget https://www.files.certum.eu/software/proCertumCardManager/Linux-Ubuntu/2.2.11/proCertumCardManager-2.2.11-x86_64-ubuntu.bin
45+
46+
# We do not install the software, just extract it
47+
/srv/codesign/proCertumCardManager-2.2.11-x86_64-ubuntu.bin --keep
48+
mv dist certum
49+
50+
# create links, if you would like to actually use the
51+
# Certum Card Manager software
52+
53+
ln -s /srv/codesign/certum/cryptoCertum3PKCS-3.0.6.69-MS.so /usr/lib/libcrypto3PKCS.so
54+
ln -s /srv/codesign/certum/cryptoCertum3PKCS-3.0.6.69-MS.so /usr/lib/libcryptoCertum3PKCS.so
55+
```
56+
57+
Now, we can check if the system sees the HSM and can show us the certificate & key details:
58+
59+
```bash
60+
$ pkcs11-tool --module /srv/codesign/certum/sc30pkcs11-3.0.6.68-MS.so --login --list-objects
61+
62+
Using slot 0 with a present token (0x1)
63+
Logging in to "profil standardowy".
64+
65+
# here you need to provide the PIN to access the card/HSM
66+
67+
Please enter User PIN:
68+
69+
# After providing the PIN, you should see the contents of the card
70+
71+
Private Key Object; RSA
72+
label: Open Source Developer, Robert Olejnik
73+
ID: 352c322687efb09df068a792c49cbac631d40cf0
74+
Usage: decrypt, sign, unwrap
75+
warning: PKCS11 function C_GetAttributeValue(ALWAYS_AUTHENTICATE) failed: rv = CKR_ATTRIBUTE_TYPE_INVALID (0x12)
76+
77+
Access: sensitive, always sensitive, never extractable, local
78+
Public Key Object; RSA 4096 bits
79+
label: Open Source Developer, Robert Olejnik
80+
ID: 352c322687efb09df068a792c49cbac631d40cf0
81+
Usage: encrypt, verify, wrap
82+
Access: local
83+
Certificate Object; type = X.509 cert
84+
label: Open Source Developer, Robert Olejnik
85+
subject: DN: C=PL, ST=zachodniopomorskie, L=Szczecin, O=Open Source Developer, CN=Open Source Developer, Robert Olejnik
86+
serial: 29EE7778CA5217107841BBBF6B3062E1
87+
ID: 352c322687efb09df068a792c49cbac631d40cf0
88+
```
89+
90+
> ! As you can see, the key ID (this is important) is: 352c322687efb09df068a792c49cbac631d40cf0
91+
92+
Now the final, let's check if the code signing works - for that we have a defguard.exe unsigned binary, which we will sign and check if it works:
93+
94+
```bash
95+
$ osslsigncode sign \
96+
-pkcs11module /srv/codesign/certum/sc30pkcs11-3.0.6.68-MS.so \
97+
-certs /srv/codesign/certificate.pem \
98+
-key 352c322687efb09df068a792c49cbac631d40cf0 \
99+
-pass <PIN> \
100+
-h sha256 \
101+
-t http://time.certum.pl/ \
102+
-in defguard.exe \
103+
-out defguard-signed.exe
104+
105+
106+
# You should see the following message and result:
107+
108+
Engine "pkcs11" set.
109+
Succeeded
110+
```
111+
112+
And checking the signature:
113+
114+
```bash
115+
$ osslsigncode verify defguard-signed.exe
116+
117+
Current PE checksum : 0134E4A0
118+
Calculated PE checksum: 0134E4A0
119+
120+
Signature Index: 0 (Primary Signature)
121+
Message digest algorithm : SHA256
122+
Current message digest : 13A86CCDF9DE5177ACC15A3AC895A1F39A652D85F6E9C3533C151D64547F930A
123+
Calculated message digest : 13A86CCDF9DE5177ACC15A3AC895A1F39A652D85F6E9C3533C151D64547F930A
124+
125+
Signer's certificate:
126+
Signer #0:
127+
Subject: /C=PL/ST=zachodniopomorskie/L=Szczecin/O=Open Source Developer/CN=Open Source Developer, Robert Olejnik
128+
Issuer : /C=PL/O=Asseco Data Systems S.A./CN=Certum Code Signing 2021 CA
129+
Serial : 29EE7778CA5217107841BBBF6B3062E1
130+
Certificate expiration date:
131+
notBefore : Mar 21 06:12:37 2024 GMT
132+
notAfter : Mar 21 06:12:36 2025 GMT
133+
134+
Number of certificates: 4
135+
Signer #0:
136+
Subject: /C=PL/ST=zachodniopomorskie/L=Szczecin/O=Open Source Developer/CN=Open Source Developer, Robert Olejnik
137+
Issuer : /C=PL/O=Asseco Data Systems S.A./CN=Certum Code Signing 2021 CA
138+
Serial : 29EE7778CA5217107841BBBF6B3062E1
139+
Certificate expiration date:
140+
notBefore : Mar 21 06:12:37 2024 GMT
141+
notAfter : Mar 21 06:12:36 2025 GMT
142+
# And so on...
143+
# And so on...
144+
# And so on...
145+
```
146+
147+
Now what is left for you to do, is add the osslsigncode sign to your pipeline, and don't forget to make the **PIN a secret.**
148+
149+
150+
Robert Olejnik - Founder, Security and Open Source Advocate

‎src/pages/blog/[slug].astro

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,7 @@ const url = `https://defguard.net/blog/${entry.slug}`;
184184
}
185185

186186
:global(pre) {
187-
background: var(--code-bg, #f6f8fa);
187+
background: var(--code-bg, #fff);
188188
padding: 1rem;
189189
border-radius: 4px;
190190
overflow-x: auto;
@@ -193,9 +193,9 @@ const url = `https://defguard.net/blog/${entry.slug}`;
193193

194194
:global(code) {
195195
font-family: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;
196-
font-size: 0.9em;
196+
font-size: 0.7em;
197197
font-weight: 300;
198-
background: var(--code-bg, #f6f8fa);
198+
background: var(--code-bg, #fff);
199199
padding: 0.2em 0.4em;
200200
border-radius: 3px;
201201
}

0 commit comments

Comments
 (0)