Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

In order to sign an application for the Apple App Store, we need to create a certificate by saving a certificate request file from keychain and then upload it to the Apple store.

I was wondering, what does this certificate request file contain?
Does the certificate contain any information (like a finger print) about the OS or hardware?

share|improve this question
    
Certificates can be exported from one PC and imported into an other; That alone proves they're not dependent on any kind of hardware or operating system fingerprint. –  Cosmin Prund Feb 25 '13 at 8:33
1  
It contains enough information to tie it back the account used to publish the application to the store. –  Ramhound Feb 25 '13 at 11:59
    
Interesting. But how about the system it's compiled on? or even more? –  Abcd Efg Feb 25 '13 at 12:09
add comment

3 Answers

up vote 3 down vote accepted

No, there's no personal information or information about your hardware configuration stored within the CSR (certificate signing request). The CSR is part of an asymmetric encryption key, ie. it is the public portion of a public and private key.

Essentially, both keys are just a bunch of random* numbers that enable Public key encryption.

Have a look at this SO question for additional details.

* No, the numbers aren't truly 'random' but it's a good enough description for this question.

share|improve this answer
2  
The private key is not in the CSR. It's created in the keychain. –  grahamparks Feb 25 '13 at 15:04
    
@grahamparks - thanks! I've edited my answer to make that part more clear. –  GlenH7 Feb 25 '13 at 15:31
    
And I believe the CSR is signed using the private key –  Krishnabhadra Feb 26 '13 at 8:15
add comment

A certificate signing request contains information about the distinguished name of the individual who generated it along with the public key.

The standard form of the request that on sees is a Base64 encoded request that contains the above mentioned distinguished name, the public key and the method that was used to generate the public key.

The RSA public (and private) key does not contain any information about your hardware.

share|improve this answer
add comment

The excerpt below comes from an article on Apple's Developer website about code signing:

To enable signed code to fulfill these purposes, a code signature consists of three parts:

  • A seal, which is a collection of checksums or hashes of the various parts of the code, such as the identifier, the Info.plist, the main executable, the resource files, and so on. The seal can be used to detect alterations to the code and to the app identifier.
  • A digital signature, which signs the seal to guarantee its integrity. The signature includes information that can be used to determine who signed the code and whether the signature is valid.
  • A unique identifier, which can be used to identify the code or to determine to which groups or categories the code belongs. This identifier can be derived from the contents of the Info.plist for the app, or can be provided explicitly by the signer.

As for more information, check out this post on why and how to do code signing from Adam Eberbach, an experienced full-time IOS developer: http://www.raywenderlich.com/2915/ios-code-signing-under-the-hood.

share|improve this answer
1  
Expand upon your answer. Link only answers are generally bad. If the link dies, your answer becomes useless. –  Glenn Nelson May 17 '13 at 13:37
add comment

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.