Purchase Code Signing Certificates

Code signing certificates validate software rather than a website, so the Certificate Signing Request (CSR) is generated on the computer that will sign the code rather than on a web server. This article walks through ordering a code signing certificate in the Reseller Control Panel (RCP) and generating the required CSR with OpenSSL.

Before you begin

• Signing computer: Use the computer that will compile and sign the code. The CSR must be generated there.
• OpenSSL: Install OpenSSL on the signing computer (Windows or macOS).
• RCP access: Sign in to the Reseller Control Panel.
• Organization details: Have the legal organization name and address ready.

Step 1: Generate the CSR

1. Launch OpenSSL on the signing computer.
   • Windows: From cmd, run C:\OpenSSL-Win32\bin\openssl.exe.
   • macOS: Open Terminal and run the openssl command.
2. Generate the request:

   req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key

3. Enter the prompted values:
   • Country code: Two-letter ISO code where your organization is legally registered.
   • State/province: Full name (no abbreviations).
   • Locality: Full city name (no abbreviations).
   • Organization name: Full legal organization name.
   • Organizational unit: Optional department name.
   • Common Name: Full legal organization name.
   • Email Address: Your email address.
   • Challenge password: Leave blank.
   • Optional company name: Leave blank.
4. Locate the CSR.csr file in the install directory. Open it in a text editor to copy the CSR text.

Step 2: Open the Trust section

1. Sign in to the Reseller Control Panel.
2. Click Trust.

Step 3: Choose the provider and product

1. Select the certificate provider from the supplier drop-down list.
2. Select the code signing certificate type compatible with the code you plan to sign.

Step 4: Enter contact information

1. Fill in the contact details for the order.

Step 5: Submit the CSR

1. Under Certificate Settings, paste the CSR you generated in Step 1.
2. Add anything relevant in the Special Instructions field.
3. Click Add Service.

Next steps

• Approve the validation email: The CA emails an approval request to validate the order.
• Track the order: Monitor the status on the Trust tab.
• Install the certificate: Once issued, import the certificate on the signing computer and pair it with the private key.

Questions? Contact OpenSRS Support.