Dr. Dobb's Journal - October 2008 - (Page 34)

D10gold_p6as 8/15/08 9:07 AM Page 34 Core Technology CODE SIGNING IN ADOBE AIR continued from page 32 documentation. This list is just intended to give you a feel for what’s involved. 1. Visit the Thawte website and select the Adobe AIR Developer Certificate. You must use Firefox. 2. Complete the Thawte enrollment process step. Your key pair is generated during this step and the private key is stored in the Firefox keystore. 3. Thawte performs an identity verification process and may request additional information. For example, Thawte uses public records to validate the existence of your business. They will also validate that you are authorized to request a certificate for the business. (Thawte, like most certification authorities, issues certificates only to businesses or organizations, not individuals.) 4. Once you’ve been notified that verification is complete, you’ll log back into the Thawte website. The certificate is saved to the Firefox keystore. 5. The Adobe signing tools can’t directly access the Firefox keystore, so you’ll have to export your keys and certificate into a PKCS12-based keystore file. (These files conform to the PKCS12 standard and are identified with either a .pfx or .p12 extension.) Now you have a usable signing certificate. However, you should consider moving your key to a hardware-based keystore. However you obtain your certificate, you need to ensure that the final keystore contains a full certificate chain. Using Authenticode Certificates You aren’t required to purchase an Adobe AIR Certificate from Thawte. You can use any certificate that is intended for code signing as designated by the extended key usage field in the certificate itself. Most certificates sold as code signing certificates qualify, including ones you might already own. For purposes of example, here are the basic steps required to use an Authenticode certificate with Adobe AIR. Note that it’s really just a matter of getting the certificate into an appropriate format. 1. First, find and download the pvkimprt tool provided by Microsoft. This loads your Authenticode certificate into the Windows keystore. 2. From the Windows keystore (accessible via Internet Options, among other places) export the certificate as a PFX file. More Signing Signing can be performed using a variety of applications including Adobe Flex Builder, Adobe Flash, Adobe Dreamweaver, and Aptana. All of these applications rely on the adt tool, which is freely available as part of the Adobe AIR and Flex SDKs. Application Identity Adobe AIR uses certificates to establish a trusted identity for an application not only at installation time but also for the entire lifetime of the installed application. This is accomplished by binding information from the certificate to the application’s identity. Application identity is critical because it impacts features like updates, invocation, and interprocess communication. For example, application identity is used in the following (not exhaustive set of) circumstances: 34 Dr. Dobb’s Journal l www.ddj.com l October 2008 http://www.getunderstand.com http://www.getunderstand.com http://www.ddj.com

Table of Contents Feed for the Digital Edition of Dr. Dobb's Journal - October 2008

Dr. Dobb's Journal - October 2008 Contents Friday Night Fish Fry Alia Vox Developer Diaries Developer’s Notebook Is Your Next Language COBOL? Conversations Safe Coding Practices Code Signing in Adobe AIR OpenID Single Sign-On The Book Cipher Algorithm Indexing and Searching Image files Extending Continuous Integration Into ALM The Agile Edge Effective Concurrency Swaine’s Flames

Dr. Dobb's Journal - October 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.