Obtaining a Software Publisher’s Certificate
by Gene Spafford, Simson Garfinkel
Web Security and Commerce
- Web Security & Commerce
- Preface
- I. Introduction
- II. User Safety
- 2. The Buggy Browser: Evolution of Risk
- 3. Java and JavaScript
- 4. Downloading Machine Code with ActiveX and Plug-Ins
- 5. Privacy
- III. Digital Certificates
- 6. Digital Identification Techniques
- Ten Policy Questions
- Is legislation necessary at all?
- Where should PKI legislation occur?
- Is licensing of certification authorities the right approach?
- Should legislation endorse public key cryptography, or be “technology neutral”?
- Should legislation endorse the X.509 paradigm?
- How should liability and risk be allocated in a PKI?
- What mechanisms should be used to allocate risk?
- Should digitally signed documents be considered “writings” for all legal purposes?
- How much evidentiary weight should a digitally signed document carry?
- Should governments act as CAs?
- 7. Certification Authorities and Server Certificates
- 8. Client-Side Digital Certificates
- 9. Code Signing and Microsoft’s Authenticode
- IV. Cryptography
- 10. Cryptography Basics
- 11. Cryptography and the Web
- 12. Understanding SSL and TLS
- V. Web Server Security
- 13. Host and Site Security
- 14. Controlling Access to Your Web Server
- 15. Secure CGI/API Programming
- VI. Commerce and Society
- 16. Digital Payments
- 17. Blocking Software and Censorship Technology
- 18. Legal Issues: Civil
- 19. Legal Issues: Criminal
- VII. Appendixes
- A. Lessons from Vineyard.NET
- Planning and Preparation
- Lesson: Whenever you are pulling wires, pull more than you need.
- Lesson: Pull all your wires in a star configuration, from a central point out to each room, rather than daisy-chained from room to room. Wire both your computers and your telephone networks as stars.
- Lesson: Use centrally located punch-down blocks or 10Base-T wiring blocks for both your computer networks and your telephone networks.
- Lesson: Don’t go overboard.
- Lesson: Plan your computer room carefully: you will have to live with its location for a long time.
- IP Connectivity
- Commercial Start-Up
- Ongoing Operations
- Security Concerns
- Lesson: Don’t run programs with a history of security problems (e.g., sendmail).
- Lesson: Make frequent backups.
- Lesson: Limit logins to your servers.
- Lesson: Beware of TCP/IP spoofing.
- Lesson: Defeat packet sniffing.
- Lesson: Restrict logins.
- Lesson: Tighten up your system beyond manufacturer recommendations.
- Lesson: Eschew free software.
- Phone Configuration and Billing Problems
- Credit Cards and ACH
- Lesson: If you have the time to write it, custom software always works better than what you can get off the shelf.
- Lesson: Live credit card numbers are dangerous.
- Lesson: Encrypt sensitive information and be careful with your decryption keys.
- Lesson: Log everything, and have lots of reports.
- Lesson: Explore a variety of payment systems.
- Lesson: Make it easy for your customers to save you money.
- Monitoring Software
- Security Concerns
- Conclusion
- Planning and Preparation
- B. Creating and Installing WebServer Certificates
- C. The SSL 3.0 Protocol
- D. The PICS Specification
- E. References
- A. Lessons from Vineyard.NET
- Index
- Colophon
Although Microsoft’s Authenticode technology should work with software publisher digital certificates from any recognized certification authority, as this book went to press the only CA that was issuing these certificates was VeriSign.
VeriSign issues two kinds of software publisher’s certificates (sometimes called software publisher’s credentials): individual certificates and commercial certificates. Personal certificates are based on VeriSign’s Class 2 digital certificates. Commercial certificates are based on VeriSign’s Class 3 certificates, similar to the company’s web server certificates. (You do not need to have a web server or a domain of your own to obtain either kind of software publisher’s certificate.)
VeriSign’s certificate requesting process is performed on the company’s Digital ID web site. Keys must be generated with Microsoft Internet Explorer 3.0 or higher. As this book went to press, keys could only be generated on computers running the Windows 95 or Windows NT 4.0 operating systems.
Keys are generated by an ActiveX control that is downloaded to the web browser. The ActiveX control invites you to store the private key on removable media, such as a floppy disk. Because floppy disks are not terribly reliable, you should copy your private key to at least one other floppy disk. Private keys are not encrypted with passphrases.
After the key is created, the public key is transmitted to VeriSign over the Internet. VeriSign validates the user’s request and sends the user a URL and a PIN that can be used to retrieve the software publisher’s certificate.
-
No Comment