You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/trusted-signing/faq.yml
+11-19Lines changed: 11 additions & 19 deletions
Original file line number
Diff line number
Diff line change
@@ -21,18 +21,7 @@ sections:
21
21
answer: |
22
22
Refer to the [Trusted Signing Program Windows Support](https://support.microsoft.com/topic/kb5022661-windows-support-for-the-azure-code-signing-program-4b505a31-fa1e-4ea6-85dd-6630229e8ef4) page for details about Windows support for Trusted Signing.
23
23
The service is supported on all currently supported versions of:
24
-
* Windows 11 (Supported out of the box)
25
-
* Windows 10 - RS5 (Windows 10, Version 1809/ October 2018 Update) or newer
26
-
* Windows Server 2019, Windows Server 2016
27
-
Files signed by Trusted Signing’s Public Trust certificates are trusted on:
28
-
* Windows Server 2012 R2 (Command line only)
29
-
* Windows 8.1
30
-
* Windows 7 SP1 ESU - Must install May 2021 update rolls up
31
-
* Windows 10 1507
32
-
Not Supported
33
-
* Windows 7 SP1 non-ESU (Not supported by Microsoft)
34
-
* Windows OS version that were already end of life
35
-
24
+
36
25
General User Mode Code Integrity (UMCI) support for Trusted Signing:
37
26
* Signed binaries was added in the July 2021 Certificate Trust List (CTL) update delivered by Windows. In standard scenarios, upon first sight of an end-entity cert from a chain on the machine, the system pulls down the root CA cert into the trust root store on a system.
38
27
- question: How do I grant API access in Microsoft Entra ID to Trusted Signing?
@@ -52,28 +41,28 @@ sections:
52
41
For Public Preview Trusted Signing is free for now. You'll still be prompted to select a Basic or Premium SKU when you create your account.
53
42
- question: What are my support options when onboarding to Trusted Signing?
54
43
answer: |
55
-
If you're a managed customer on Azure, and have a support plan you can create a support ticket with the service on the Azure portal and be assisted by Azure customer support. Otherwise, we recommend you go to Microsoft Q&A or StackOverflow under the tag Trusted-Signing to ask questions.
44
+
You can create a support ticket with the service on the Azure portal and be assisted by Azure customer support. Otherwise, we recommend you go to Microsoft Q&A or StackOverflow under the tag Trusted-Signing to ask questions.
56
45
- name: Certificate Profiles and Identity Validation
57
46
questions:
58
47
- question: What if my Trusted Signing subject name is different than my old cert and my MSIX's package name is now different?
59
48
answer: |
60
49
Follow the persistent identity guidance in the [MSIX Persistent Identity](https://learn.microsoft.com/windows/msix/package/persistent-identity) article.
61
50
- question: Does deleting the certificate profile revoke the certificates?
62
51
answer: |
63
-
No. If you delete the certificate profile, any certificates that were previously issued or used under that profile will remain - they won't be revoked.
52
+
No. If you delete a certificate profile, any certificates that were previously issued or used under that profile will remain valid - they won't be revoked.
64
53
- question: Does Trusted Signing allow me to use a custom CN?
65
54
answer: |
66
-
Per the CA/B Forum baseline requirements for publicly trusted code signing certs, CN values must be the legal entity's validated name (e.g. Microsoft Corporation) so there isn't much flexibility in CN values. However, a `O` value allows for verified legal names, trade names, and DBAs (doing business as). For individuals, there are already requirements for verification of individuals in the baseline requirements that we meet.
55
+
Per the CA/B Forum baseline requirements for publicly trusted code signing certs, CN values must be the legal entity's validated name (e.g. Microsoft Corporation) so there isn't much flexibility in CN values.
67
56
- name: Signing
68
57
questions:
69
-
- question: What is Trusted Signing’s compliance level?
58
+
- question: What is Trusted Signing’s HSM compliance level?
70
59
answer: |
71
60
FIPS 140-2 level 3 (mHSMs)
72
61
- question: How to include the appropriate EKU for our certificates into the ELAM driver resources?
73
62
answer: |
74
63
- For information regarding ELAM driver config for Protected Anti-Malware Services, refer to the following guidance: "Beginning in 2022, all user mode anti-malware service binaries must be signed by Microsoft's Trusted Signing signing service. The Trusted Signing issued Authenticode certificate for signing anti-malware binaries is updated every 30 days for security. To prevent the need to update the ELAM driver every time the certificate is updated, we recommend that anti-malware vendors include the Trusted Signing PCA certificate TBS hash in the CertHash portion of the ELAM driver resource file info. Additionally, the anti-malware vendor must include their unique Trusted Signing EKU identity in the EKU field of the resource file info. The EKU identity will begin with the prefix *1.3.6.1.4.1.311.97.*."
75
64
- See the [PKI Repository](https://www.microsoft.com/pkiops/docs/repository.htm) page for the Microsoft ID Verified Code Signing PCA 2021 cert.
76
-
- question: What happens if we run Trusted Signing binaries on a signed on machine that doesn't have the Trusted Signing update (especially binaries that are INTEGRITYCHECK-ed)?
65
+
- question: What happens if we run binaries signed with Trusted Signing on a machine that doesn't have the Trusted Signing update (especially binaries that are INTEGRITYCHECK-ed)?
77
66
answer: |
78
67
- If an INTEGRITYCHECK flag is set, the user's signature isn't validated at runtime and isn't run with INTEGRITYCHECK.
79
68
- To check if Trusted Signing update is installed or not, we recommend that you check against one of your packaged /IntegrityCheck-linked DLLs. A dummy one works, too. That way you can complete your check independently of the platform and the availability of our IntegrityCheck-linked binaries.
@@ -124,7 +113,10 @@ sections:
124
113
- After creating the Client ID and Secret, navigate to the Resource Group (or Subscription) that has the Trusted Signing Certificate Profile Signer role and add this App to the role.
125
114
- question: What if my Trusted Signing account is suspended?
126
115
answer: |
127
-
We suspend accounts and or revoke signing certificates if the certificate is found to be misused or abused per our service's Terms of Use. We engage with you directly in such cases following the Code Signing Baseline Requirements (CSBRs) guidelines.
128
-
116
+
Trusted Signing will suspend accounts and or revoke signing certificates if the certificate is found to be misused or abused per our service's Terms of Use. We engage with you directly in such cases following the Code Signing Baseline Requirements (CSBRs) guidelines.
117
+
- question: What if I get Azure.Identity.CredentialUnavailableException?
118
+
answer: |
119
+
You should expect to see this error on environments outside of Azure [see here](https://github.com/Azure/azure-sdk-for-net/issues/29471). Recommendation is to "exclude ManagedIdentity" if you are outside of Azure.
description: How-to rerenew a Trusted Signing Identity Validation.
4
+
author: mehasharma
5
+
ms.author: mesharm
6
+
ms.service: trusted-signing
7
+
ms.topic: how-to
8
+
ms.date: 04/12/2024
9
+
---
10
+
11
+
# Renew Trusted Signing Identity Validation
12
+
13
+
You can check the expiration date of your Identity Validation on the Identity Validation page. You can renew your Trusted Signing Identity Validation 60 days before the expiration. A notification is to the primary and secondary email addresses with the reminder to renew your Identity Validation.
14
+
**Identity Validation can only be completed in the Azure portal – it can not be completed with Azure CLI.**
15
+
16
+
>[!Note]
17
+
>Failure to renew Identity Validation before the expiration date will stop certificate renewal, effectively halting the signing process associated with those specific certificate profiles.
18
+
19
+
1. Navigate to your Trusted Signing account in the [Azure portal](https://portal.azure.com/).
20
+
2. Confirm you have the **Trusted Signing Identity Verifier role**.
21
+
- To learn more about Role Based Access management (RBAC) access management, see [Assigning roles in Trusted Signing](tutorial-assign-roles.md).
22
+
3. From either the Trusted Signing account overview page or from Objects, select **Identity Validation**.
23
+
4. Select the Identity Validation request that needs to be renewed. Select **Renew** on the top.
24
+
25
+
:::image type="content" source="media/trusted-signing-renew-identity-validation.png" alt-text="Screenshot of trusted-signing-renew-identity-validation.png." lightbox="media/trusted-signing-renew-identity-validation.png":::
26
+
27
+
5. If you encounter validation errors while renewing through the renew button or if Identity Validation is Expired, you need to create a new Identity Validation.
28
+
- To learn more about creating new Identity Validation, see [Quickstart](quickstart.md).
29
+
6. After the Identity Validation status changes to Completed.
30
+
7. To ensure you can continue with your existing metadata.json.
31
+
- Navigate back to the trusted signing account overview page or from Objects, select **Certificate Profile**.
32
+
- On the **Certificate Profiles**, delete the existing cert profile associated to the Identity Validation expiring soon:
33
+
- Create new cert profile with the same name.
34
+
- Select the Identity Validation from the pull-down. Once the certificate profile is created successfully, signing resumes requiring no configuration changes on your end.
Copy file name to clipboardExpand all lines: articles/trusted-signing/quickstart.md
+46-35Lines changed: 46 additions & 35 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,6 +6,7 @@ ms.author: mesharm
6
6
ms.service: trusted-signing
7
7
ms.topic: quickstart
8
8
ms.date: 04/12/2024
9
+
ms.custom: references_regions
9
10
---
10
11
11
12
@@ -47,16 +48,38 @@ A resource provider is a service that supplies Azure resources. Use the Azure po
47
48
48
49
# [Azure CLI](#tab/registerrp-cli)
49
50
50
-
You can register Trusted Signing resource provider with the commands below:
51
+
1. If you're using a local installation, login to Azure CLI using the `az login` command.
52
+
53
+
2. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see [Sign in with the Azure CLI](/cli/azure/authenticate-azure-cli).
54
+
55
+
3. When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see Use extensions with the [Azure CLI](/cli/azure/azure-cli-extensions-overview).
56
+
57
+
4. To see the versions of Azure CLI and dependent libraries that are installed, use the `az version` command.
58
+
• To upgrade to the latest version, use the following command:
59
+
60
+
```bash
61
+
az upgrade [--all {false, true}]
62
+
[--allow-preview {false, true}]
63
+
[--yes]
64
+
```
65
+
66
+
5. To set your default subscription ID, use the `az account set -s <subscriptionId>` command.
67
+
68
+
6. You can register Trusted Signing resource provider with the command below:
51
69
52
70
```
53
71
az provider register --namespace "Microsoft.CodeSigning"
54
72
```
55
73
56
-
You can verify that registration is complete with the commands below:
74
+
7.You can verify that registration is complete with the command below:
57
75
58
76
```
59
-
az provider show --namespace "microsoft.ConfidentialLedger"
77
+
az provider show --namespace "Microsoft.CodeSigning"
78
+
```
79
+
80
+
8. You can add the extension for Trusted Signing with the command below:
81
+
```
82
+
az extension add --name trustedsigning
60
83
```
61
84
62
85
---
@@ -72,13 +95,12 @@ The resources must be created in Azure regions where Trusted Signing is currentl
72
95
| Region | Region Class Fields | Endpoint URI Value |
| East US | EastUS |`https://eus.codesigning.azure.net`|
113
-
| West US3<sup>[1](#myfootnote1)</sup> | WestUS3|`https://wus3.codesigning.azure.net`|
135
+
| West US | WestUS|`https://wus.codesigning.azure.net`|
114
136
| West Central US | WestCentralUS |`https://wcus.codesigning.azure.net`|
115
137
| West US 2 | WestUS2 |`https://wus2.codesigning.azure.net`|
116
138
| North Europe | NorthEurope |`https://neu.codesigning.azure.net`|
117
139
| West Europe | WestEurope |`https://weu.codesigning.azure.net`|
118
140
119
-
<aname="myfootnote1">1</a>: WestUS3 coming soon!
120
141
121
142
Complete the following steps to create a Trusted Signing account with Azure CLI:
122
143
123
-
1. If you're using a local installation, login to Azure CLI using the `az login` command.
124
-
125
-
2. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see [Sign in with the Azure CLI](/cli/azure/authenticate-azure-cli).
126
-
127
-
3. When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see Use extensions with the [Azure CLI](/cli/azure/azure-cli-extensions-overview).
128
-
129
-
4. To see the versions of Azure CLI and dependent libraries that are installed, use the `az version` command.
130
-
• To upgrade to the latest version, use the following command:
131
-
132
-
```bash
133
-
az upgrade [--all {false, true}]
134
-
[--allow-preview {false, true}]
135
-
[--yes]
136
-
```
137
-
138
-
5. To set your default subscription ID, use the `az account set -s <subscriptionId>` command.
139
-
140
-
6. Create a resource group using the following command:
144
+
1. Create a resource group using the following command (Skip this step if you plan to use an existing resource group):
141
145
142
146
```
143
147
az group create --name MyResourceGroup --location EastUS
144
148
```
145
149
146
-
- To list accounts under the resource group, use the `trustedsigning list -g MyResourceGroup` command.
147
-
148
-
7. Create a unique Trusted Signing account using the following command. (See the below Certificate Profile naming constraints for naming requirements.)
150
+
2. Create a unique Trusted Signing account using the following command. (See the below Certificate Profile naming constraints for naming requirements.)
8. Verify your Trusted Signing account using the `trustedsigning show -g MyResourceGroup -n MyAccount` command.
161
+
3. Verify your Trusted Signing account using the `trustedsigning show -g MyResourceGroup -n MyAccount` command.
162
+
163
+
>[!Note]
164
+
>If you are using older version of CLI from Trusted Signing Private Preview, your account is defaulted to Basic SKU. To use Premium either upgrade CLI to latest version or use Azure portal to create account.
0 commit comments