Freeplane code signing certificate issues

classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

Freeplane code signing certificate issues

Dimitry Polivaev
Administrator
Hello devs,

my current developer freeplane code signing certificate expires soon and I need to order a new one. Because old provider Certum providing certificates until now has changed the conditions, I want to discuss with you which certificate to order.

In any case code signing is required for using freeplane java applets and java web based start freeplane viewer and also for installer for Windows. The expanses for this year are covered by donations I have already collected so that I do not need to spend my own money for this purpose.

Ordering certum open source certificate under the new conditions means spending 135,- EUR this year and about 35,- EUR in each following year because they distribute their certificates only on their own cryptographic cards which should be bought and delivered by them for a lot of money. They do it because of https://casecurity.org/2016/12/08/leading-certificate-authorities-and-microsoft-introduce-new-standards-to-protect-consumers-online/ .

I am afraid that use of their certificate is possible only with their card and under windows, but actually it is OK for me.

There commercial alternatives which costs about 80$/year and they say nothing about cryptographic cards. I do not know why they do not follow the recommendations yet.

So I am not quite sure which certificate to order. I give certum a light preference.

What do you think?

Regards,
Dimitry

Reply | Threaded
Open this post in threaded view
|

Re: Freeplane code signing certificate issues

Felix Natter
hello Dimitry,

> I am afraid that use of their certificate is possible only with their card and under windows, but actually it is OK for me.

I think we can switch to another certificate in the case that someone other than you shall generated the signed jar?
I don't see this in the near future, so I think it's ok :-)

Cheers and Best Regards,
Felix