Artifact Signing certificate management

This article describes Artifact Signing certificates, including short-lived certificates, certificate profile-specific Extended Key Usage (EKU) values, zero-touch certificate lifecycle management, time stamp countersignatures, and Microsoft's active threat monitoring and revocation actions.

The certificates that are used in the Artifact Signing service follow standard practices for X.509 code signing certificates. To support a healthy ecosystem, the service includes a fully managed experience for X.509 certificates and asymmetric keys for signing. The fully managed Artifact Signing experience provides all certificate lifecycle actions for all certificates in an Artifact Signing certificate profile resource.

Certificate attributes

Artifact Signing uses the certificate profile resource type to create and manage X.509 v3 certificates that Artifact Signing customers use for signing. The certificates conform to the RFC 5280 standard and to relevant Microsoft PKI Services Certificate Policy (CP) and Certification Practice Statements (CPS) resources that are in the Microsoft PKI Services repository.

In addition to standard features, certificate profiles in Artifact Signing include the following two unique features to help mitigate risks and impacts that are associated with misuse or abuse of certificate signing:

• Short-lived certificates
• Certificate profile Extended Key Usage (EKU) for durable profile identification.

Short-lived certificates

To help reduce the impact of signing misuse and abuse, Artifact Signing certificates are renewed daily and are valid for only 72 hours. In these short-lived certificates, revocation actions can be as acute as a single day or as broad as needed to cover any incidents of misuse and abuse.

For example, if it's determined that a subscriber signed code that was malware or a potentially unwanted application (PUA) as defined in How Microsoft identifies malware and potentially unwanted applications, revocation actions can be isolated to revoking only the certificate that signed the malware or PUA. The revocation affects only the code that was signed by using that certificate on the day that it was issued. The revocation doesn't apply to any code that was signed before that day or after that day.

Certificate profile EKU

Artifact Signing certificates renew daily, so pinning trust to an individual certificate's public key, thumbprint, or other certificate attributes isn't durable. To support durable identification across certificate renewals, Artifact Signing assigns a custom Extended Key Usage (EKU) value to each certificate profile. Certificates issued from the same certificate profile contain the same profile-specific EKU for the lifetime of that profile. The EKU is associated with the certificate profile, not with the subscriber or identity validation resource.

• Deleting and recreating a certificate profile The certificate profile EKU stays the same for certificates issued from an existing certificate profile. If you delete the certificate profile and create a new one, Artifact Signing assigns a new EKU to the new profile. This change applies even when the new profile belongs to the same subscriber or uses the same identity validation resource. You must update any application or policy pinned to the previous certificate profile EKU to trust the new EKU.

Artifact Signing provides a durable identity value in each certificate that's associated with the certificate profile. The durable identity value is a custom EKU that has the prefix 1.3.6.1.4.1.311.97. and is followed by more octet values that are unique to the certificate profile. Here are some examples:

• Public Trust certificate profile example

  A value of  1.3.6.1.4.1.311.97.990309390.766961637.194916062.941502583 identifies an Artifact Signing Public Trust certificate profile. The  1.3.6.1.4.1.311.97.  prefix identifies the Artifact Signing Public Trust code signing type. The remaining values uniquely identify the certificate profile.

• Private Trust identity validation example

  A value of 1.3.6.1.4.1.311.97.1.3.1.29433.35007.34545.16815.37291.11644.53265.56135 indicates an Artifact Signing subscriber that uses Private Trust identity validation. The 1.3.6.1.4.1.311.97.1.3.1. prefix is the Artifact Signing Private Trust code signing type. The 29433.35007.34545.16815.37291.11644.53265.56135 value is unique to the subscriber's identity validation for Private Trust.

  Because you can use Private Trust identity validations for Windows Defender Application Control (WDAC) code integrity (CI) policy signing, they have a different EKU prefix: 1.3.6.1.4.1.311.97.1.4.1.. But the suffix values match the durable identity value for the subscriber's identity validation for Private Trust.

All Artifact Signing Public Trust certificates also contain the 1.3.6.1.4.1.311.97.1.0 EKU to be easily identified as a publicly trusted certificate from Artifact Signing. All EKUs are provided in addition to the code signing EKU (1.3.6.1.5.5.7.3.3) to identify the specific usage type for certificate consumers. The only exception is certificates that are the Artifact Signing Private Trust CI Policy certificate profile type, in which no code signing EKU is present.

Zero-touch certificate lifecycle management

Artifact Signing aims to simplify signing as much as possible for each subscriber. A major part of simplifying signing is to provide a fully automated certificate lifecycle management solution. The Artifact Signing zero-touch certificate lifecycle management feature automatically handles all standard certificate actions for you.

It includes:

• Secure key generation, storage, and usage in FIPS 140-3 Level 3 hardware crypto modules that the service manages.
• Daily renewals of certificates to ensure that you always have a valid certificate to use to sign your certificate profile resources.

Every certificate that you create and issue is logged in the Azure portal. You can view logging data feeds that include certificate serial number, thumbprint, created date, expiry date, and status (for example, Active, Expired, or Revoked) in the portal.

Time stamp countersignatures

The standard practice in signing is to countersign all signatures with an RFC 3161-compliant time stamp. Because Artifact Signing uses short-lived certificates, time stamp countersigning is critical for a signature to be valid beyond the life of the signing certificate. A time stamp countersignature provides a cryptographically secure time stamp token from a Time Stamping Authority (TSA) that meets the standards of the Code Signing Baseline Requirements (CSBRs).

A countersignature provides a reliable date and time of when signing occurred. If the time stamp countersignature is inside the signing certificate's validity period and the TSA certificate's validity period, the signature is valid. It's valid long after the signing certificate and the TSA certificate expire (unless either are revoked).

Artifact Signing provides a generally available TSA endpoint at http://timestamp.acs.microsoft.com. We recommend that all Artifact Signing subscribers use this TSA endpoint to countersign any signatures they produce.

Active monitoring

Artifact Signing passionately supports a healthy ecosystem by using active threat intelligence monitoring to constantly look for cases of misuse and abuse of Artifact Signing subscribers' Public Trust certificates.

• For a confirmed case of misuse or abuse, Artifact Signing immediately takes the necessary steps to mitigate and remediate any threats, including targeted or broad certificate revocation and account suspension.

• You can complete revocation actions directly in the Azure portal for any certificates that are logged under a certificate profile that you own.

Next step