Developer's Guide to Web Application Security

Q: Do I have to purchase a digital certificate to sign a control?

A: If you’re planning to release the control for external use, you will need to pur-

chase a valid certificate from the CA of your choice. However, while you are

testing, you can use Makecert.exe and the Cert2SPC.exe utilities to make a test

certificate.These utilities are included in the ActiveX SDK.

Q: My company already has a server certificate. Can I use that to sign my code?

A: No, you cannot sign code with a server certificate. A server certificate has a dif-

ferent function than a code-signing certificate. All a server certificate does is

allow secure transmission of data between the ser ...