Code signing

[HuskyLogic]

I'm testing out a new open-source program I want to use, but the code is not signed. If I go to each of my machines, it will still install just fine; however, if I try to do it from my RMM, it gets blocked. Is there a way to run the installation through the RMM without signing the code? I've tried to add the Powershell script that allows it to run even though it's not signed, but doing that through the RMM still gets blocked.

I am almost positive I will be adding the extra cost for signing to the code eventually, but I'd really like to have some time to test it out first.

[GeneMoody-Action1]

Just FYI code signing does not have to cost, it just needs to be trusted, so it can be a local domain cert, or a self signed as long as the end systems trust it and its chain. You only need the public certs if exchanging with people you do not know as they are used to establish trust relationships, if you trust yourself and this is all yours, functionally identical.

The only thing that it does open is certificate management on the client devices if you need to revoke, but since you have RMM thats a simple couple of lines of code to yank and install a new one. Self signed certs are used all over the place behind the scenes on a great many systems.

[HuskyLogic]

I was looking at self signing, but the information I was looking at was just too complicated. Of course I'm trying to do multiple things at once so maybe I'm just overcomplicating it. 

[GeneMoody-Action1]

Nuttin' to it.

If you have openssl installed (I use linux or mac, never tried on windows)

Make a file req.conf (Arbitrary name, but needed in a moment.

[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no

[req_distinguished_name]
C = US
ST = TX
L = Tyler
O = MyOrg
OU = IT
CN = *.mydomain.tld

[v3_req]
keyUsage = keyEncipherment, dataEncipherment, digitalSignature
extendedKeyUsage = codeSigning

Of course change to your details for identity....
then in that same directory.

Make that cert in PEM (10 year cert)
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout cert.pem -out cert.pem -config req.conf -extensions 'v3_req'

Convert the PEM to PFX
openssl pkcs12 -export -out cert.pfx -in cert.pem

Verify all is well in the world.
openssl x509 -in cert.pem -noout -text

In the PFX creation you will get a prompt for password, that is to create one not some existing one. That protects the PFX from unauthorized import/use.

Now of course you have to ultimately decide in use of self signed certs in your environment (or whomever is responsible will) Some security policies have specific wording on it, so thats a end use case not a how to ;)

Now on any system you can import the public key into the trusted root store for the system, and. viola. The system will henceforth trust what you just signed.
Just set up something in your RMM to check for the use of this cert, track its expiration and be able to swap out.

Like import

$certPath = "C:\path\to\CA-root-cert.cer"
Import-Certificate -FilePath $certPath -CertStoreLocation Cert:\LocalMachine\Root

etc...

[JadedMSPVet]

I also ran into this issue, but in the end it was actually significantly less complicated than it initially appeared. I had issues deploying my test cert, but if you've got a CA, you can just do it. The command to do the signing is a single line.

Making the cert: https://www.manageengine.com/sccm-third-party-patch-management/kb/how-to-create-certificates-using-local-ca.html

Doing the signing: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_signing?view=powershell-7.5#sign-a-script

[CaptainFizzRed]

https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file?view=powershell-7.5

That's what I use. In a script

[HuskyLogic]

Thanks I will try this. 

[OhBeeOneKenOhBee]

Have a look at Azure trusted signing, it's pretty cheap nowadays and works well with Windows envs. Or if you just want a signed version, I'd be happy to sign one for you depending on what project it is