# How to? - Self Signed Code Signing Certificate and Certificate Store **URL:** \ **Category:** questions\ **Tags:** code-signing\ **Created:** [June 4, 2024, 5:48am UTC](https://clarionhub.com/t/how-to-self-signed-code-signing-certificate-and-certificate-store/7213 "2024-06-04T05:48:10Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Johan\_de\_Klerk](https://clarionhub.com/letter_avatar_proxy/v4/letter/j/f9ae1b/32.png) [@Johan\_de\_Klerk](https://clarionhub.com/u/Johan_de_Klerk)\ **Post date:** [June 4, 2024, 5:48am UTC](https://clarionhub.com/t/how-to-self-signed-code-signing-certificate-and-certificate-store/7213/1 "2024-06-04T05:48:11Z")
Hi everyone, My Code Sign certificate is due for renewal next month. Had a quick look and for a 3 year certificate via Setup Builder it will cost ±R14 000.00. The last certificate 3 years ago was ±R4 000.00. This new type of certificate seems to me like one big money grabbing scheme. Is there a way to create my own self signed code sign certificate? Then run a small program on my users machine and register this self signed certificate in their certificate store so it could be trusted? Any ideas and advice would be appreciated. Regards Johan de Klerk ---
**Author:** ![ncik](https://clarionhub.com/user_avatar/clarionhub.com/ncik/32/1468_2.png) [@ncik](https://clarionhub.com/u/ncik)\ **Post date:** [June 4, 2024, 11:21am UTC](https://clarionhub.com/t/how-to-self-signed-code-signing-certificate-and-certificate-store/7213/2 "2024-06-04T11:21:03Z")
Hi, I create all the time self signed certificates for SSL and you can add them to the store. Usually I set expire 10 years. I do not know anything about code sign so maybe it is different. Check if this helps [How To Create a Self-Signed SSL Certificate for Nginx in Ubuntu 20.04 | DigitalOcean](https://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-nginx-in-ubuntu-20-04-1) hth Nenad ---
**Author:** ![Johan\_de\_Klerk](https://clarionhub.com/letter_avatar_proxy/v4/letter/j/f9ae1b/32.png) [@Johan\_de\_Klerk](https://clarionhub.com/u/Johan_de_Klerk)\ **Post date:** [June 4, 2024, 11:50am UTC](https://clarionhub.com/t/how-to-self-signed-code-signing-certificate-and-certificate-store/7213/3 "2024-06-04T11:50:29Z")
Hi Nenad, Thanks for your reply. However yours is for web. The code signing certificate is for signing application files (EXE’s, etc.) Regards Johan de Klerk ---
**Author:** ![bsm-software](https://clarionhub.com/letter_avatar_proxy/v4/letter/b/977dab/32.png) [@bsm-software](https://clarionhub.com/u/bsm-software)\ **Post date:** [June 5, 2024, 9:40am UTC](https://clarionhub.com/t/how-to-self-signed-code-signing-certificate-and-certificate-store/7213/4 "2024-06-05T09:40:07Z")
Hi! My certificate is also expiring. I have not been certifying my programmes for a few weeks now. So far there have been no problems. Perhaps the hash code of the EXE and the DLLs should be enclosed ? Bernd ---
**Author:** ![Johan\_de\_Klerk](https://clarionhub.com/letter_avatar_proxy/v4/letter/j/f9ae1b/32.png) [@Johan\_de\_Klerk](https://clarionhub.com/u/Johan_de_Klerk)\ **Post date:** [June 5, 2024, 10:33am UTC](https://clarionhub.com/t/how-to-self-signed-code-signing-certificate-and-certificate-store/7213/5 "2024-06-05T10:33:11Z")
Hi Bernd, > [@bsm-software](#): > > Perhaps the hash code of the EXE and the DLLs should be enclosed ? You have me at a disadvantage here. Please explain what you mean. Regards Johan de Klerk ---
**Author:** ![bsm-software](https://clarionhub.com/letter_avatar_proxy/v4/letter/b/977dab/32.png) [@bsm-software](https://clarionhub.com/u/bsm-software)\ **Post date:** [June 5, 2024, 11:57am UTC](https://clarionhub.com/t/how-to-self-signed-code-signing-certificate-and-certificate-store/7213/6 "2024-06-05T11:57:08Z")
Example: msvcr90.dll msvcr90.dll.md5 ---
**Author:** ![bsm-software](https://clarionhub.com/letter_avatar_proxy/v4/letter/b/977dab/32.png) [@bsm-software](https://clarionhub.com/u/bsm-software)\ **Post date:** [June 5, 2024, 11:57am UTC](https://clarionhub.com/t/how-to-self-signed-code-signing-certificate-and-certificate-store/7213/7 "2024-06-05T11:57:38Z")
cdbe9690cf2b8409facad94fac9479c9 \*msvcr90.dll ---
**Author:** ![bsm-software](https://clarionhub.com/letter_avatar_proxy/v4/letter/b/977dab/32.png) [@bsm-software](https://clarionhub.com/u/bsm-software)\ **Post date:** [June 5, 2024, 12:10pm UTC](https://clarionhub.com/t/how-to-self-signed-code-signing-certificate-and-certificate-store/7213/8 "2024-06-05T12:10:49Z")
There is also a validation programme: see WIN-SFV32 ---
**Author:** ![jslarve](https://clarionhub.com/letter_avatar_proxy/v4/letter/j/e480ec/32.png) [@jslarve](https://clarionhub.com/u/jslarve)\ **Post date:** [June 6, 2024, 12:36am UTC](https://clarionhub.com/t/how-to-self-signed-code-signing-certificate-and-certificate-store/7213/9 "2024-06-06T00:36:50Z")
Luckily, anyone who modifies the DLL won’t know how to generate MD5. ---
**Author:** ![bsm-software](https://clarionhub.com/letter_avatar_proxy/v4/letter/b/977dab/32.png) [@bsm-software](https://clarionhub.com/u/bsm-software)\ **Post date:** [June 6, 2024, 8:32am UTC](https://clarionhub.com/t/how-to-self-signed-code-signing-certificate-and-certificate-store/7213/10 "2024-06-06T08:32:17Z")
In my opinion, there is nothing to be said against checking the most important exe/dll when starting the programme. ---
**Author:** ![jslarve](https://clarionhub.com/letter_avatar_proxy/v4/letter/j/e480ec/32.png) [@jslarve](https://clarionhub.com/u/jslarve)\ **Post date:** [June 6, 2024, 11:25am UTC](https://clarionhub.com/t/how-to-self-signed-code-signing-certificate-and-certificate-store/7213/11 "2024-06-06T11:25:24Z")
> [@bsm-software](#): > > there is nothing to be said against checking the most important exe/dll when starting the programme. I agree with that, but there is a false sense of security with this exercise, and moreso when distributing both the EXE and the md5 together :). Not saying that code signing is bulletproof either, but it’s more of a verifiable way to ensure that the source of the files was the entity that signed them. (But it’s still a racket, IMO.) ---
**Author:** ![CarlBarnes](https://clarionhub.com/user_avatar/clarionhub.com/carlbarnes/32/1859_2.png) [@CarlBarnes](https://clarionhub.com/u/CarlBarnes)\ **Post date:** [June 6, 2024, 2:03pm UTC](https://clarionhub.com/t/how-to-self-signed-code-signing-certificate-and-certificate-store/7213/12 "2024-06-06T14:03:08Z")
> [@Johan\_de\_Klerk](#): > > Is there a way to create my own self signed code sign certificate? > Then run a small program on my users machine and register this self signed certificate in their certificate store so it could be trusted? This is something done when learning or testing Code Signing. If you Google _“testing code signing with self signed certificate”_ you’ll find a bunch of results. Here are a few… [https://mmus.me/blog/certificates/](https://mmus.me/blog/certificates/) [https://signmycode.com/resources/how-to-generate-self-signed-code-signing-certificate](https://signmycode.com/resources/how-to-generate-self-signed-code-signing-certificate) [https://signmycode.com/blog/self-signed-vs-publicly-trusted-ca-code-signing-certificates](https://signmycode.com/blog/self-signed-vs-publicly-trusted-ca-code-signing-certificates) and many more… ---
**Author:** ![bsm-software](https://clarionhub.com/letter_avatar_proxy/v4/letter/b/977dab/32.png) [@bsm-software](https://clarionhub.com/u/bsm-software)\ **Post date:** [June 7, 2024, 8:03am UTC](https://clarionhub.com/t/how-to-self-signed-code-signing-certificate-and-certificate-store/7213/13 "2024-06-07T08:03:20Z")
Better: The MD5 code should be stored securely (encrypted) or be retrievable via IP/REST. ---
**Author:** ![jslarve](https://clarionhub.com/letter_avatar_proxy/v4/letter/j/e480ec/32.png) [@jslarve](https://clarionhub.com/u/jslarve)\ **Post date:** [June 7, 2024, 3:03pm UTC](https://clarionhub.com/t/how-to-self-signed-code-signing-certificate-and-certificate-store/7213/14 "2024-06-07T15:03:08Z")
> [@bsm-software](#): > > Better: > The MD5 code should be stored securely (encrypted) or be retrievable via IP/REST. Pretty sure this alternative was covered on the first day of planning the journey to designing the certificate authority infrastructure. ---
**Author:** ![CarlBarnes](https://clarionhub.com/user_avatar/clarionhub.com/carlbarnes/32/1859_2.png) [@CarlBarnes](https://clarionhub.com/u/CarlBarnes)\ **Post date:** [June 7, 2024, 4:20pm UTC](https://clarionhub.com/t/how-to-self-signed-code-signing-certificate-and-certificate-store/7213/15 "2024-06-07T16:20:13Z")
> [@bsm-software](#): > > Better: > The MD5 code should be stored securely (encrypted) or be retrievable via IP/REST. I think the OP wants normal Code Signing that way it can be used in all the typical ways everyone knows. Like the User can view it in Explorer, installs can be confirmed signed and AV programs can check it.