Digital Certificate Inquiry

[janice_2k4]

Dear members,
I am very new in digital certificates and authentication matters. I created an exe application ( 2 dlls are required to run this application) for my e-learning website. Currently, I found problem in accessing the application from the browser on computers with XP, IE 6.0.2800. ActiveX bugs keep disabling me to run the exe file. However, after I enable download unsigned ActiveX controls, a message box displaying 'ActiveX control on this page might be unsafe...Yes/No' pop up. If I click Yes, it will run my exe application smoothly. Therefore, I wonder if I digitally sign my application could solve this security problem.

Another query is that whether can I find any free digital certificates as I have a tight budget for my project. I searched on the net and most of them provide 30 days free trial, which is not sufficient enough for my website. How much is the cost of digital certificates? Looking forward to some reply soon.

Thanks in advance,
Janice

[AdamGundry]

I'm not that familiar with digitally signing ActiveX controls, but you might be able to get a free certificate at CAcert.org (http://www.cacert.org/). However, I would strongly advise against using ActiveX on your website: not only are there major security risks, so users may not be prepared to run the control, but you force your users to use Windows and Internet Explorer.

Adam

[janice_2k4]

Hi AdamGundry,
Thanks for your reply. Actually, the application I developed is an exe. As I am using vbscript to call the exe, I suppose the 'CreateObject' command was the cause for the ActiveX pop up. I am confused with digital certificate and authenticode ID. Are they the same? Do I need both to solve my problem? Looking forward to your reply soon.

Thanks in advance,
Janice

[AdamGundry]

Authenticode is the Microsoft technology for signing applications, which uses digital IDs (aka digital certificates) to verify the publisher of the program. For more information, check out the Verisign (http://www.verisign.com.au/developer/msauthenticode.shtml) and Microsoft (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnauth/html/signfaq.asp) pages on the subject.

I'm not sure if a CAcert digital certificate allows code signing, or whether you will need to pay for one from a certificate authority such as Verisign.

Adam

[janice_2k4]

Thanks AdamGundry. Have a nice day.

Cheers,
Janice