Hacker News Reader

Comment by paradite | Hacker News Reader

Hi. I'm an electron app developer. I use electron builder paired with AWS S3 for auto update.

I have always put Windows signing on hold due to the cost of commercial certificate.

Is the Azure Trusted Signing significantly cheaper than obtaining a commercial certificate? Can I run it on my CI as part of my build pipeline?

View on HN

Azure Trusted Signing is one of the best things Microsoft has done for app developers last year, I'm really happy with it. It's $9.99/month and open both to companies and individuals who can verify their identity (it used to only be companies). You really just call signtool.exe with a custom dll.

I wrote @electron/windows-sign specifically to cover it: https://github.com/electron/windows-sign

Reference implementation: https://github.com/felixrieseberg/windows95/blob/master/forg...

The big limitation with Azure Trusted Signing is that your organization needs to be at least 3 years old. Seems to be a weird case where developers that could benefit from this solution are pushed towards doing something else, with no big reason to switch back later.

That limitation should go away when Trusted Signing graduates from preview to GA. The current limitation is because the CA rules say you must perform identity validation of the requester for orgs younger than 3 years old, which Microsoft isn't set up for yet.

This is not true. Or maybe it is but they missed me? I signed up with a brand new company without issue.

Hi. This is very helpful. Thanks for sharing!

Reply on news.ycombinator.com