cdrtfe Homepage

Introduction

Since 2012 with cdrtfe 1.4.1 this project has digitally signed the installers and main program files with a code signing certificate which itself was issued by a trusted CA (Certificate Authority).

On February 1, 2017, the new Minimum Requirements for Code Signing Certificates (PDF) came into effect. As a result, the only code signing certificate specifically available for open source developers got more expensive. In addition the validation process became more complicated as well.

Taking into account the low number of downloads, the costs, the difficulties I experienced with the last validation process and the fact that cdrtfe is just a hobby project, it is no longer worth buying such a certificate.

Beginning with version 1.5.9 cdrtfe will no longer use trusted CA issued code signing certificates. Instead, the project will switch to self-signed code signing certificates.

What will change?

Well, the main difference is that during installation this more or less friendly dialog

becomes this less friendly and a little more scary dialog

So, does this mean that cdrtfe is less safe now?

No, it doesn't. To begin with, the mere fact that a software is digitally signed does not automatically mean that this software can be trusted, is safe to use or free of bugs. A digital signature just allows the authenticity and integrity of the software to be verified.

I. Authenticity

While anyone can create self-signed certificates, the combination of issued common name (CN) and certificate thumbprint is unique. By comparing these two attributes, you can be confident that the software was indeed signed by the owner of this certificate.

II. Integrity

A digital signature allows it to check, whether the software has been modified since it has been signed. So you can detect e.g. corrupted downloads or - even worse - software that has been tampered with.

Windows both checks the signature and the certificate used to sign the software. And even if the certificate cannot be verified because it hasn't been issued by a trusted CA, Windows will still tell you, if the signature itself is valid (= integrity ok) or not (= corrupted or tampered with).

Check the authenticity of cdrtfe

To check the authenticity of cdrtfe (e.g. the executable installer or the main program file) follow these steps:

• Right click the file (.exe), select Properties
• Select Digital Signatures
• Under Signature list, select the signature
• Click Details
• Click View Certificate
• Select Details
• Scroll down to Thumbprint

cdrtfe (version 1.5.9 onwards) is currently signed with these two certificates:

sha1 signature:

Subject:
  C = DE
  O = cdrtfe OpenSource Software
  CN = cdrtfe project, emailAddress = kerberos002@users.sourceforge.net

Issuer:
  C = DE
  O = cdrtfe OpenSource Software
  CN = cdrtfe CA Intermediate 1, emailAddress = kerberos002@users.sourceforge.net

SHA1 Fingerprint:
  30:93:84:96:C4:1D:BE:CC:06:84:6B:5E:27:6B:15:41:7B:F1:AA:2F

sha256 signature:

Subject:
  C = DE
  O = cdrtfe OpenSource Software
  CN = cdrtfe project, emailAddress = kerberos002@users.sourceforge.net

Issuer:
  C = DE
  O = cdrtfe OpenSource Software
  CN = cdrtfe CA Intermediate 2, emailAddress = kerberos002@users.sourceforge.net

SHA1 Fingerprint:
  1B:64:17:E0:63:8B:F3:44:7B:C1:9C:37:81:CF:4A:C5:F3:91:26:3C

Check the integrity of cdrtfe

To check the integrity of cdrtfe (e.g. the executable installer or the main program file) follow these steps:

• Right click the file (.exe), select Properties
• Select Digital Signatures
• Under Signature list, select the signature
• Click Details

Now, there are four possibilities, depending on the certificate used:

I. Code Signing certificate issued by a trusted CA (cdrtfe 1.4.1 - 1.5.8), verification successful

This file is safe to use. The signature is ok and the certificate could be verified.

II. Self-signed Code Signing certificate (cdrtfe 1.5.9 onwards), verification successful

This file is safe to use. The signature is ok, the certificate could not be verified (as it is self-signed).

III. Code Signing certificate issued by a trusted CA (cdrtfe 1.4.1 - 1.5.8), verification not successful

This file is not safe to use. The signature is invalid as the file is corrupted.

IV. Self-signed Code Signing certificate (cdrtfe 1.5.9 onwards), verification not successful

This file is not safe to use. The signature is invalid as the file is corrupted.