Problem - Kevin Tafuro

The type of code-signing certificate required determines the specific requirements for
making the request to VeriSign to obtain it. For a Microsoft Authenticode Digital ID,
for example, much of the work is automated through Microsoft’s Internet Explorer,
while a Sun Java Signing Digital ID requires you to generate a certificate request
using Sun’s Java tools to be submitted along with the request. For each type of certificate,
VeriSign supplies full instructions on what information is needed and how to
go about obtaining and supplying it to VeriSign.
While each type of code-signing certificate has its own specific requirements for
making the request, they all also have common requirements that must be met as
well. Most of the requirements are self-explanatory, such as contact and payment
information. Each certificate must also have information about who owns the certificate.
Such information includes the name of the company or organization and the
location from which it does business. For example, a company doing business from
the United States would be required to supply the city and state in which they’re
located.
There is also, of course, the very important need for the CA (VeriSign, in this case) to
verify that they are issuing the certificate to someone that should legitimately have it.
The quickest and easiest way for VeriSign to verify this information is with a Dun &
Bradstreet DUNS number, a unique identifying number for businesses that is widely
used. Supplying this information is optional, but the alternatives require more time
and effort both on your part and VeriSign’s. If you do not have or do not want to use
a DUNS number, you can optionally mail or fax, along with your request for a codesigning
certificate, copies of your business license, articles of incorporation, or partnership
papers.
Once your request, including any appropriate documentation, has been submitted,
VeriSign will review the submission. If everything is in order, VeriSign will issue a
code-signing certificate, along with instructions on how to retrieve the certificate so
that you may distribute and use it. In contrast to requests for personal certificates,
requests for code-signing certificates are reviewed and verified by an actual living
human being, so the certificate is not immediately available. Depending on Veri-
Sign’s workload, it may take several days for a certificate to be issued, although Veri-
Sign will expedite requests for an additional fee.
Web site certificates
The process for obtaining a certificate for use in securing a web site, which VeriSign
calls a secure server certificate, is very similar to the process for obtaining a certificate
for code signing. Much of the same information is required, although there are some
differences worth noting. Obviously, one of the primary differences is in the types of
certificates offered. While code-signing certificates differ based on the type of code
that will be signed (Netscape plug-ins versus Java applets, for example), secure server
certificates are either 40-bit or 128-bit SSLcertificates. That is, web site certificates
explicitly restrict the size of the symmetric keys that should be used with the certifi-
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Obtaining a Certificate | 517