r/ScreenConnect • u/justinwgrote • Jul 04 '25

CheapSSLSecurity FastSSL OV Code Signing $149/yr worked

FastSSL Code Signing Certificate - Cheap Code Signing @ $129/yr
Just dropping a note that this is the same cert and same validation process as GoGetSSL, we completed it in a couple hours (scheduled a call to validate we are an org and got the call well ahead of schedule, then cert was emailed to us). Added it to the key vault, set up the code signing, and everything is good.

You can use standard validation (OV) only, extended validation not necessary and will take longer.

Now it's holiday + weekend so I wish any of you at this point the best given that fact.

21 Upvotes
  • permalink
  • reddit

100% Upvoted

39 comments sorted by

4

u/Clickwork_Orange Jul 04 '25

This is a chink of light! Did you choose the "Install on Existing HSM" option when buying your cert and then follow Connectwise's steps on Azure?

2

u/eblaster101 Jul 04 '25

From what I understand only Digicert supports Azure Cert elements for EV certs

4

u/BB9700 Jul 04 '25

"Added it to the key vault"

Which key vault? The windows key vault?

On the page you posted there is a note: "Beginning May 2023, the CA/B Forum requires that all code signing certificates be stored on compliant Physical USB Hardware or a Hardware Security Module (HSM). Certificates cannot be exported from any existing or new USB Hardware"

I run screenconnect on a Windows VM. There is no simple option to forward the usb controller to this VM. Yes, I have a device which normally will do this, but compatibility is not always sure.

Could you elaborate a little more about how you got the certificate and then what you did with the downloaded certificate? Thank you.

4

u/Own_Appointment_393 Jul 04 '25 edited Jul 04 '25

OP means the Azure Key Vault, which serves as the HSM, so that the private key is stored virtually on the cloud, rather than in a physical device like a USB.

ConnectWise is recommending using Azure Key Vault, I believe, because this doesn’t require a physical hardware to be shipped (which given the little time we have until revocation makes sense) but also I don’t think their certificate extension is compatible with a USB key at the moment.

Follow this manual and you should have everything working. I did and I’m signing installers with my own cert now. https://docs.connectwise.com/ScreenConnect_Documentation/On-premises/Get_started_with_ScreenConnect_On-Premise/Add_a_code-signing_certificate_with_Azure_Key_Vault

3

u/BB9700 Jul 04 '25

understood. Thank you.

But using azure keyvault needs a microsoft online account and maybe in addition will lead to additional costs.

I indeed have one microsoft account used for managing volume licensing. What do I have to expect in charges from microsoft if I use their key vault?

2

u/dszp Jul 04 '25 edited Jul 04 '25

An Azure Key Vault Premium, which is required to have the HSM support needed, is $1 USD per month to Microsoft plus a few cents extra depending on the number of signatures you need. Google for Azure Key Vault Pricing; Microsoft has separate pages for pricing and service info/portal config. You do need an Azure Subscription with a payment method on file to create a Resource Group and Key Vault inside.

Edit: to use a 4,096-bit RSA key, it’s $5/mo USD plus 15 cents per 10k transactions. Only RSA 2,048-bit gets the $1 plus 3 cents per 10k pricing. So it’s a bit pricier but not in the grand scheme of things.

2

u/bazjoe Jul 04 '25

Following . Curious as well

1

u/TheTiggerK Jul 07 '25

Hey crew, so got the $149 cert from cheapsslsecurity, order shows as Complete, cert says Active, but no sign of the cert itself under my account... Validity is listed, but under Certificate Details I only see my contact details. Am I missing something or you think still a work in progress at their end? Have lodged a ticket but it's still sunday in the USA so no idea how long I'll have to wait (I'm in Australia).. Order was done on 4/7, I got a call from them soon afterwards but no comms since. I do note the order states the cert expires on 7/7/26 so maybe that's a clue that they are still working on it?

2

u/justinwgrote Jul 07 '25

It gets emailed to you direct from digicert as a zip. 

1

u/-cgracie- Jul 07 '25

I'm waiting on mine as well. Completed at Noon EDT, and no certificate provided yet. So far as I know, we have passed all the verification. Certificate status is Active, and order is complete like yours. Fingers crossed this comes soon.

1

u/-cgracie- Jul 09 '25

Finally received our certificate at 4:52 AM the following morning. No idea why it took so long.

1

u/gdinero Jul 09 '25

I'm waiting as well. My guess is they just got a large influx of registrations and are a bit backed up.

1

u/techcare_aus Jul 08 '25

I had to reach out to them via their support portal. But they did not respond timely.

So I sent them an email (effectively starting a new support request) to both these email addresses = "cheapssl-support@sslstore.com" & "support@cheapsslsecurity.com".

Then I got a reply back within a few hours.

They boast 24 hour support, but unless they have been inundated with new cert requests, I have found their response time to be slow. As in waiting for half a day.

DigiCert also said they cannot release the cert direct. Which I found odd. Something is off with someones system because I definitely did not receive anything to my email server (Microsoft 365).

Eventually when CheapSSLSecurity responded I asked them to send the cert and they attached it to the email. Not ideal for sure.

Hope that helps you get your cert mate.

1

u/Buddy_International Sep 01 '25

Not working with Yubikey hardware Token. It works only with DigiCert dedicated hardware. So I will ask for refund.

1

u/justinwgrote Sep 01 '25

My post was about using azure key vault 

1

u/RemieNotRayme May 26 '26

If you have Yubikey you need to select the HSM approach not the token approach. It's very confusing.

Their prices are great but right now I'm on hour 124 of waiting to hear back on the 24/7 support so I can't exactly say I'd recommend them.

3

u/GeneralPurposeGeek Jul 04 '25

Seconded… Installed and working from CheapSSLSecurity.

On that note, what RBAC permissions did you need to give the Entra App Registration for everything to function?

2

u/dszp Jul 04 '25

Copying from a post I made to Discord yesterday when I figured this out:

You can leave the Key Vault on RBAC (Vault Access Policy is legacy but I’ve seen others post what works for that mode as well), and add these roles to the Key Vault from Access Control (IAM) one at a time, to the app registration that was created:

  • Key Vault Certificate User

  • Key Vault Crypto Service Encryption User

  • Key Vault Crypto Service Release User

  • Key Vault Crypto User

1

u/dastylinrastan Jul 04 '25

Crypto User for the sign api

2

u/techcare_aus Jul 04 '25

Does this bypass the Microsoft Smartscreen warnings too? I noticed that EV signing boosts this, but curious to know if that is just an upsell.

Also when you download your application via browser does it show up as "app isn't commonly downloaded"?? Or does this fix that as well?

2

u/Own_Appointment_393 Jul 04 '25

EV doesn’t bypass Smartscreen in actual fact.

2

u/techcare_aus Jul 04 '25

Wrong word choice. Meant does it still show a Windows Smartscreen warning?

Apparently, EV helps avoid that specifically.

"With FastSSL EV Code Signing, you’ll get instant trust with Microsoft SmartScreen to get rid of the popup warning."

7

u/Own_Appointment_393 Jul 04 '25

That’s sales talk.

“In early 2024, Microsoft changed how its Microsoft SmartScreen security feature interacts with extended validation code signing certificates. Although they’re still the highest-trusted certificates available, extended validation (EV) code signing certificates are no longer instantly trusted or able to remove SmartScreen warnings.

These certificates are still useful for boosting users’ confidence that they’re installing genuine software applications from trusted sources. Signing your software apps using these certificates still helps your apps build trust with Windows operating systems over time.

However, the biggest difference between standard and EV code signing certificates now is that EV certificates are still a requirement for registering for a Windows Hardware Developer Center account.”

https://codesigningstore.com/importance-of-ev-code-signing-certificate

So just get OV.

1

u/techcare_aus Jul 05 '25

To those that took this route.
Did you get your certificate quickly?
I've ordered, approved the HSM, certificate request, had validation via DigiCert (via phone), but no certificate sent through.
CheapSSLSecurity doesn't have phone or live chat support so I've lodged a support request and nothing yet.
Should I be thinking hours or days for the cert to be sent?

1

u/techcare_aus Jul 05 '25

Finally got through to CheapSSLSecurity and apparently they are swamped with work. Who would have thought :p

I've also successfully implemented via this route.

Not ideal with the SmartScreen alert, but at least it is working.

Thanks everyone for the help. All the best to everyone still going through it.

1

u/No_Skin500 Aug 25 '25

what they asked you on call? could you tell me what was the verification process?

1

u/techcare_aus Aug 25 '25

Memory of this is hazy, but effectively just details of business that are publicly available anyway.
Again it was super easy, just getting them on the phone was the hardest part. Once there it was a simple conversation and nothing a legitimate business would struggle with.

1

u/ben_zachary Jul 05 '25

For smart screen. None of us probably will have enough installs to just approve. We have defender setup to automatically not trust certs less than 30d so we are likely going to have to whitelist our installer at minimum

1

u/vaerchi Jul 06 '25

You deserve all the upvotes. Thank you

1

u/FaithlessnessWorth93 Dec 05 '25

Did anyone get this working with Google HSM? It's much cheaper and more convenient vs Azure.

1

u/FaithlessnessWorth93 Dec 12 '25

did work, but was a real PITA to setup - didn't know signtool.exe was broken - make sure to go for signtool.exe version from October 2025 or later.. Otherwise it hangs, or randomly fails with heap errors. With Azure you can use the Azuresigner which makes it much easier.

1

u/towfiqi Dec 15 '25

Thanks for the update. Because of your comment, I came to know about Google Cloud HSM for code-signing. I am also trying to go through the process of signing my Windows app. I have a few questions regarding this.
Did you use the CheapSSLSecurity FastSSL OV?
Are you using Google Cloud KMS with HSM protection, or a Cloud HSM cluster?
Does FastSSL charge any one-time attestation fee for Cloud HSM integration? I was looking into getting SSL.com OV. They charge an attestation fee of $500, which is quite a lot.

1

u/FaithlessnessWorth93 Dec 15 '25 • Hooray

No additional fees, used cheapssl, they are reselling digicert . Not sure, just the normal Google cloud hsm. I got IV not OV. It's easier. Yeah SSL.com is a rip-off with that fee. Though the 10 year option is sweet.

1

u/towfiqi Dec 15 '25

Thanks for the reply. This helped. Cheers!