What is code signing?
D5 · Crypto · CompTIA Security+ SY0-701Code signing is the practice of applying a digital signature to software — applications, scripts, updates, drivers — using a code signing certificate issued by a CA. This allows users and systems to verify that the software is authentic (from a trusted developer) and hasn't been tampered with since signing.
How it works: Developer hashes the code → encrypts hash with their private key (the signature) → attaches certificate → user's OS verifies signature using developer's public key.
How it works: Developer hashes the code → encrypts hash with their private key (the signature) → attaches certificate → user's OS verifies signature using developer's public key.
Code signing prevents supply chain attacks and malware masquerading as legitimate software. Windows requires driver code signing. macOS requires app notarization (Apple's enhanced code signing). Browsers check extension signatures. Without code signing, attackers could modify a software installer during transit and users wouldn't know.