Commander un certificat de signature de code EV
Important
L'industrie passe à une clé RSA 3072 bits minimum pour les certificats de signature de code
Pour se conformer aux changements de l'industrie, DigiCert a apporté les modifications suivantes à son processus de certificat de signature de code :
N'émet que des certificats de signature de code avec une clé RSA 3072 bits ou supérieure*.
Utilise de nouvelles AC intermédiaires et des certificats racine pour émettre nos certificats de signature de code et de signature de code EV : RSA et ECC
Modifications de l'eToken et du HSM
DigiCert prend en charge deux eTokens :
5110 CC pour les certificats de clé RSA 4096 bits et ECC P-256 bits
5110 FIPS pour les certificats de clé ECC P-256 et P-384 bits.
SafeNet eToken 5110+ FIPS for RSA 4096-bit and ECC P-256-bit key certificates.
Le HSM doit :
Prendre en charge les tailles de clés RSA 3072 bits ou ECC P-256 bits ou plus.
Relever de périphériques conformes à la norme FIPS 140-2 niveau 2+ ou aux critères communs EAL4+.
*Remarque : Tous les certificats de signature de code de clé 2048 bits existants émis avant le 1er juin 2021 resteront actifs. Vous pouvez continuer à utiliser ces certificats pour signer du code jusqu'à leur expiration.
En savoir plus sur le passage aux certificats de signature de code à clé de 3072 bits..
Avant de commencer
Prévalidation de l'organisationPrévalidez l'organisation pour laquelle vous souhaitez obtenir un certificat de signature de code EV. Consultez les pages Ajouter une organisation et Soumettre une organisation à prévalidation.
Prévalidation de l'organisationPrévalidez l'organisation pour laquelle vous souhaitez obtenir un certificat de signature de code EV. Consultez les pages Ajouter une organisation et Soumettre une organisation à prévalidation.
Générer un CSR (commandes HSM uniquement)Si vous émettez à nouveau votre certificat de signature de code EV pour un périphérique HSM, vous devez soumettre une demande de signature de certificat (CSR) avec votre demande.
Générer un CSR (commandes HSM uniquement)Si vous émettez à nouveau votre certificat de signature de code EV pour un périphérique HSM, vous devez soumettre une demande de signature de certificat (CSR) avec votre demande.
Pour rester sécurisés, les certificats doivent utiliser une clé d'une taille minimale RSA 3072 bits ou ECC P-256 bits. Consultez la documentation de votre fournisseur de HSM pour créer la CSR pour votre demande.
Commandez votre certificat de signature de code EV
In the left main menu, hover over Request a Certificate. Under Code Signing Certificates, select EV Code Signing.
On the Request EV Code Signing Certificate page, in the For dropdown, select the division to manage the certificate.
The For dropdown only appears if your account uses Divisions.
Paramètres du certificat
Période de validité
Sélectionnez une période de validité pour le certificat : 1 an, 2 ans, ou 3 ans.
If needed, you can customize the expiration date or certificate length. However, you cannot exceed the 39-month maximum EV code signing certificate validity.
Renouvellement automatique
Pour activer le renouvellement automatique pour ce certificat, cochez la case Auto-renew order 30 days before expiration (Renouveler automatiquement la commande 30 jours avant expiration).
Lorsque le renouvellement automatique est activé, une nouvelle commande de certificat est soumise chaque fois que le certificat précédente approche de sa date d’expiration. S’il reste encore du temps avant l’expiration de votre certificat, DigiCert l’ajoute à la période de validité du nouveau certificat (jusqu’à 39 mois).
Important
If your certificate still has time remaining before it expires, DigiCert adds the remaining time from your current certificate to your new certificate (up to 39 months).
Organization
Organisation
Select Add organization. The organization name will appear on the EV code signing certificate.
Dans le menu déroulant, sélectionnez l'organisation pour laquelle vous commandez le certificat de signature de code EV. Le nom de l’organisation apparaîtra sur le certificat de signature de code EV
In the Add organization window, do one of the following:
Add an existing organization.
Select An existing organization.
In the dropdown, select the organization and then select Add.
If you choose an organization not validated for EV Code Signing certificates or if the organization's EV code signing validation has expired, DigiCert must validate the organization for EV code signing validation before we can issue your certificate.
Organization and technical contacts.
DigiCert automatically adds the contacts assigned to the organization to the request form. To see the organization and technical contacts, select Show organization contacts.
Verified contacts.
DigiCert automatically adds the assigned contacts to the request form if the organization has EV code signing verified contacts. To view, change selections, or add verified contacts, expand Verified contacts.
The Add contacts popup window opens if the organization has not assigned EV code signing verified contacts. In this window, you can add yourself, a user in your account, or a new contact as a verified contact. See Verified contacts below.
Add a new organization.
Select A new organization and select Next.
Under Organization address details, enter your organization's legal name, assumed name (optional), address, and phone number.
DigiCert must validate the organization for EV code signing validation before we can issue your certificate.
When ready, select Add.
Add an organization contact.
In the Add organization window, add yourself or someone else from your account, or create a new organization contact.
Important
The organization contact is whom we contact when validating the organization and verifying your authority to order a DigiCert certificate for the organization.
They may also receive the following notifications:
Order status updates for certificates requested for their organization.
Domain status updates for domains associated with their organization.
Add yourself as the organization contact.
Select Add me as the organization contact and then select Add or Next.
If we have all your information, you will select Add.
If we need more information, you will select Next, enter the missing information, and then select Add.
Add someone else as the organization contact.
Select Add someone else as the organization contact. Then in the Add contact dropdown, select the contact or user and then select Add or Next.
If we have the needed user information, you will select Add.
If we need more user information, you will select Next, enter the missing information, and then select Add.
Create new contact.
Select Add someone else as the organization contact.
In the Add contact dropdown, select Create new contact and then select Next.
Enter the needed user information and then select Add.
Technical contact for the organization (optional)
We may contact a technical contact for inquiries regarding certificate orders for the organization. They may receive the certificate lifecycle-related emails: certificate issued, reissued, and expiring.
Add yourself as the technical contact.
Select Add me as the technical contact for the organization and then select Add or Next.
If we have all your information, you will select Add.
If we need more information, you will select Next, enter the missing information, and then select Add.
Add someone else as the technical contact.
Select Add someone else as the technical contact for the organization. Then in the Add contact dropdown, select the contact or user and then select Add or Next.
If we have the needed user information, you will select Add.
If we need more user information, you will select Next, enter the missing information, and then select Add.
Create new contact.
Select Add someone else as the technical contact for the organization.
In the Add contact dropdown, select Create new contact and then select Next.
Enter the needed user information and then select Add.
Verified contacts
A verified contact must represent the organization included in your certificate request. At least one EV code signing verified contact is required.
To view, change selections, or add verified contacts, expand Verified contacts.
Select verified contacts.
If the organization has multiple EV code signing verified contacts, you can select who receives the EV code signing order approval email.
DigiCert sends the approval email to all selected, verified contacts, but only one needs to approve your order. Once the order is approved, DigiCert can issue your certificate. Selecting multiple verified contacts increases the likelihood of your order being approved quickly.
Add a verified contact.
When adding a new verified contact, we will contact the organization directly to verify the individual's name, email, phone number, job title, and authority. Only after DigiCert validates a verified contact can they approve EV code signing orders for the organization.
Add yourself as the verified contact.
Select Add me as a verified contact for the organization and then select Add or Next.
If we have all your information, you will select Add.
If we need more information, you will select Next, enter the missing information, and then select Add.
Add someone else as the verified contact.
Select Add someone else as the verified contact for the organization. Then in the Add contact dropdown, select the contact or user and then select Add or Next.
If we have the needed user information, you will select Add.
If we need more user information, you will select Next, enter the missing information, and then select Add.
Create new contact.
Select Add someone else as the verified contact for the organization.
In the Add contact dropdown, select Create new contact and then select Next.
Enter the needed information and then select Add.
Courriels supplémentaires
Saisissez les adresses e-mail (séparées par une virgule) des personnes à qui vous souhaitez envoyer les notifications d’évènements relatifs au certificat, tels que l’émission, le renouvellement, etc.
Depending on your account settings, your administrator may require you to include at least one additional email.
Additional certificate options
The information below is optional. None of it is required to issue your EV code signing certificate.
Unité organisationnelle
L’ajout d’une unité organisationnelle est facultatif. Vous pouvez laisser ce champ vide dans le formulaire.
L’ajout d’une unité organisationnelle est facultatif. Vous pouvez laisser ce champ vide dans le formulaire.
Options d'approvisionnement
Provisioning options
The provisioning method refers to where you will store the private key and certificate. For the security of your EV Code Signing certificate, the certificate must be installed on and used from an approved device.
Select the storage device for your EV Code Signing certificate and its' private key.
DigiCert-provided hardware token.
DigiCert ships you a secure token with instructions for installing the certificate on your token, so you can start signing code.
Then, under Shipping address, add your shipping information: your name and the address where you want us to send the hardware token.
Use existing token.
After DigiCert issues your EV code signing certificate, you need to install the certificate on your token.
In the Platform dropdown, select the type of hardware token on which you plan to install your EV Code Signing certificate:
SafeNet eToken 5110 CC for RSA 4096-bit and ECC P-256-bit or higher key certificates.
SafeNet eToken 5110 FIPS for ECC P-256 and P-384-bit key certificates.
SafeNet eToken 5110+ FIPS for RSA 4096-bit and ECC P-256-bit or higher key certificates.
Important
You must have a FIPS 140-2 Level 2 or Common Criteria EAL4+ compliant device. See Currently Supported eTokens. You cannot install the certificate on any device not on the list.
If you don't have one of the approved tokens, please select the option to have a DigiCert-provided hardware token shipped to you. If you have any questions, please contact DigiCert Support.
Install on HSM
After DigiCert issues your EV code signing certificate, install it on the HSM where you generated the private key and CSR.
Select Yes under Was the private key generated by a Common Criteria EAL4+ standard or FIPS 140-2 level 2 HSM?
Note that we will send the certificate requestor an agreement email. This email is to ensure that a private key is stored on an HSM that is certified as FIPS 140 Level 2, Common Criteria EAL 4+, or equivalent. DigiCert will only issue the certificate after the requester agrees to the private key protection requirement.
Important
You must have a FIPS 140 Level 2, Common Criteria EAL 4+, or equivalent hardware security module (HSM) that supports at least 3072-bit keys.
Select a different provisioning method if you don't have a compatible HSM. If you have any questions, please contact DigiCert Support.
Additional order options
The information below is optional. None of it is required to issue your certificate.
Comments to Administrator (optional)
Enter any information your administrator might need for approving your request, about the purpose of the certificate, etc.
Message de renouvellement supplémentaire
Pour créer un message de renouvellement pour ce certificat, saisissez un message de renouvellement contenant les informations utiles dans le cadre du renouvellement.
Informations sur le paiement
Sélectionner une méthode de paiement
Sous Payment Information (Informations de paiement), sélectionnez une méthode de paiement pour le certificat.
Facturer sur la carte bancaire
Vous ne disposez pas de contrat ou ne souhaitez pas utiliser votre contrat pour payer ce certificat ? Réglez votre certificat par carte bancaire :
Nous autorisons le paiement par carte une fois la demande effectuée. En revanche, nous ne terminons la transaction qu’après avoir émis le certificat.
Si vous avez un contrat en cours, cochez Exclude from contract terms (Exclure du contrat).
Facturer sur le solde du compte
Vous ne disposez pas de contrat ou ne souhaitez pas utiliser votre contrat pour payer ce certificat ? Vous avez la possibilité d’imputer le coût au solde de votre compte.
Pour déposer des fonds, cliquez sur le lien Deposit (Dépôt). Ce lien vous dirige vers une autre page de votre compte CertCentral. Les informations saisies dans le formulaire de demande ne seront pas enregistrées.
Si vous avez un contrat en cours, cochez Exclude from contract terms (Exclure du contrat).
Payer via le contrat
Vous disposez d’un contrat et souhaitez l’utiliser pour payer le certificat ? Lorsque vous disposez d’un contrat, cette méthode est la méthode de paiement par défaut.
Contrat de services de certification
Veuillez lire et comprendre le contrat, puis cocher la case I agree to the Certificate Services Agreement above (J’accepte le Contrat de services de certification ci-dessus).
Cliquez sur Submit Certificate Request (Envoyer la demande de certificat).
Selecting Submit Certificate Request also means you agree to all the terms and conditions in the Master Services Agreement.
Et ensuite ?
DigiCert recommends that developers take precautions with the code signing process and protect the private key associated with their signing certificate. See Protect private keys: Code signing best practices.