Survey of code signing authorities

August 2008 Survey of Code Signing Authorities

This survey only considers that code signing authority roots built into Microsoft Windows, since the point of code signing is to put on a signature that the operating system recognizes.

• http://msdn.microsoft.com/en-us/library/ms995347.aspx - Microsoft Root Certificate Program Members
  • Here are the ones that have code signing Survey August 2008

    Mmebers	Secure E-Mail	Server Authentication	Client Authentication	Code Signing	Time Stamping	Adobe Air Developer Certificate
    AOL ( http://www.aol.com )	Yes	Yes	Yes	Yes	Yes	No	Doesn't sell certs.
    A-Trust ( http://www.a-trust.at )	Yes	Yes	Yes	Yes	Yes	No	Multifunction chip cards, and digital signatures. Does seem to sell code signing certs. Site in German.
    Autoridad de Certificacion Firmaprofesional	Yes	Yes	Yes	Yes	Yes	?
    Baltimore ( http://www.baltimore.com )	Yes	Yes	Yes	Yes	No	?	Baltimore hotels, hotel guide? Huh?
    Belgacom E-Trust ( http://www.e-trust.be )	Yes	Yes	Yes	Yes	Yes	?	Offering eID, which is like the Microsoft passport service. The development kit costs only 1035 euros, and the reigstration kit is only 800 euros.
    CC Signet ( http://www.signet.pl )	Yes	Yes	Yes	Yes	Yes	?	Polish site, hard to tell if they actually sell certs.
    CAMERFIRMA ( http://www.camerfirma.com )	Yes	Yes	Yes	Yes	Yes	No	Spanish site
    CertPlus ( http://www.certplus.com )	Yes	Yes	Yes	Yes	No	No	Changed to keynectis.com - Trust transactions, smart cargs, ssl certs, electronic document signatures.
    Comodo Group ( http://www.comodogroup.com/ )	Yes	Yes	Yes	Yes	Yes	No	Sells only authenticode certs. More info below.
    ComSign ( http://www.ComSign.co.il )	Yes	Yes	Yes	Yes	Yes	?	Israeli site, with "verisign secured" checkmark
    Entrust ( http://www.entrust.com/certificate_services/index.htm )	Yes	Yes	Yes	Yes	Yes	No	Sells SSL, but not code signing certs
    First Data Digital Certificates ( http://www.firstdata.com/index.jsp )	Yes	No	Yes	Yes	Yes	No	doesn't sell certs
    GeoTrust ( http://www.geotrust.com )	Yes	Yes	Yes	Yes	Yes	Through verisign	GeoTrust is now offering premier Internet Code Signing products through our parent company, VeriSign.
    GlobalSign ( http://www.globalsign.com/ )	Yes	Yes	Yes	Yes	Yes	No	More info below
    GoDaddy ( http://www.godaddy.com )	Yes	Yes	Yes	Yes	No	No	Doesn't seem to offer code signing. No matches for authenticode.
    Quovadis ( http://www.quovadis.bm/ )	Yes	Yes	Yes	Yes	Yes	?	Lots of cert services, including chaining off their roots
    RSA ( http://www.rsasecurity.com/ )	Yes	Yes	Yes	Yes	Yes	No	Doesn't seem to sell secure certs.
    SECOM Trust.net ( http://www.secomtrust.net )	Yes	Yes	Yes	Yes	Yes	?	Chinese lagnuage. "Total information service" Their site search returned no hits for "Code signing"
    Serasa ( http://www.serasa.com/ )	Yes	Yes	Yes	Yes	Yes	?	An Experian company. Default site is in portuguese. Didn't seem to sell certs.
    Sonera ( http://www.sonera.com/ )	Yes	Yes	Yes	Yes	Yes	?	Redirects to http://www.sonera.fi/eng/ which is not in english. Doesn't appear to sell certs.
    TDC ( http://www.tdc.dk )	Yes	Yes	Yes	Yes	Yes	?	Site in german. Seller of internet access.
    Thawte ( http://www.thawte.com/ )	Yes	Yes	Yes	Yes	Yes	Yes
    TW Government Root Certification Authority	Yes	Yes	Yes	Yes	Yes	?
    Unizeto Certum ( http://www.certum.pl )	Yes Yes Yes Yes Yes	?	Polish site. Associated with http://certum.eu which doesn't sell code signing certs
    UserTRUST ( http://www.usertrust.com/ ) Based on COMODO	Yes	Yes	No	Yes	No	No	Doesn't seem to have anything to do with selling certs.
    Verisign ( http://www.verisign.com/ )	Yes	Yes	Yes	Yes	Yes	Yes
    XRamp ( http://www.xramp.com )	Yes	Yes	Yes	Yes	Yes	No	Not selling any code signing certs. Do sell S/MIME certs

Seems that Thawte and Verisign are enjoying their biopoly on sales of the air code signing certs.