Question

I really hope I’m misunderstanding applying certificates to Adobe AIR applications. Certificates are expensive for my budget at around $300 or more last I checked. I don’t quite understand the process yet, but it reads like I must purchase a certificate for a single version of a single application. I believe it is called code-signing certificate. And, it certifies that the code hasn’t been altered since the certificate was issued. I can understand how customers downloading the application from various sources might feel safe knowing the code hasn’t changed, but how do I release new certified versions? Must I buy another certificate each time I update the code? Or do I own the certificate for a period of time and can use it to sign new code at my liesure? Can I use the same certificate to sign several applications? I can’t imagine having to buy lots of certificates for all of my company’s applications and ever minor version change.

Answer 1

A Code Signing certificate is not for verifying that the code has not changed since the certificate was issued, it’s to verify that the code has not changed since the code was “signed”. Big difference.

A specific certificate is not tied to a particular piece of work, nor to a version of that work. It is tied to an identity.

The OTHER purpose of a code signing certificate is to verify the identity of the organization that signed it. It is to verify that the application actually came from a verified person/organization, so you know you can trust it.

So when you sign some code you are letting the user know that it is YOU that is providing that code and that the code has not changed since you signed it.

That means that there is no reason that you could not use the same certificate to sign multiple versions of multiple applications, because it is your organizations identity that you are verifying.

Also, it is actually important that you use the same certificate for an update as you do for the previous version or you can break the application. Changing an applications certificate has a bit of a process to it.

Certificates do expire after a time, so you will need to update the certificates once-in-a-while.

Hope this helps.