Podcast
Root Causes 248: Azure Code Signing Announced


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
October 18, 2022
Microsoft has announced the upcoming availability of a Microsoft-run code signing solution inside the Azure platform. We explain this approach's advantages and what to expect from it.
Podcast Transcript
Lightly edited for flow and brevity.
And the gist of it is that Microsoft has announced that it will be deploying a code signing solution inside of the Azure environment so that as you deploy and run Azure code, code in Azure, you can actually deploy your code, you can sign your code directly inside of the service as part of the service.
It is currently just announced. It is not even in preview mode or I think it might be in very preview mode but it’s not really this isn’t a live deployed thing yet but Microsoft is letting us all know that it is coming.
So, first point, once again, bravo Microsoft. It's one of the things you guys do so well, which is to ingratiate yourself to the developer community and to build tools that make a developer’s life easier. If you think about code signing, when the baby is born out of the developer’s mind and the code is complete, signing that code is – Tim, we’ve talked about it numerous times - code signing is a good idea.
And Microsoft here is basically allowing developers to do, is to make sure that none of their resources – files, certificates, etc. – ever leaves their environment. It’s a good thing. And, Tim, I think the other big, big bullet point and this is the one that I know you’ll chime in on - certificate lifecycle management. They’re formalizing it within an environment that developers are working in directly. So, the idea that you don’t have to specifically protect or manage the certificates, the ability to revoke is right there; these are the things that Microsoft has in their blog post and that they are talking about. So, once again, bravo Microsoft putting certificate lifecycle management exactly where it needs to be. I think it’s all good.
Tim, in our product roadmaps and things that we work on integrations and bringing together tools, reducing friction, making the life of the practitioner who is actually doing these things - even if they are not a PKI specialist – bringing it into their toolsets. Reducing the number of specialized toolsets and bringing it into the toolsets that these people use the most. That’s a phenomenal story that I hope continues in the industry and I don’t think anybody does it better than Microsoft – as I say, to brings tools to the developer that developers love and live in and then to integrate important functionalities directly to them so they can truly live in that environment.
The other one that I want to call out is Fast Remediation Options - Ability to quickly detect, investigate, revoke certificates on improper use. So, they are trying to offer – this is what we talk about as certificate lifecycle management. This is Microsoft acknowledging that certificate lifecycle management is a very important aspect of certificates. To the degree that they are building it directly into their public cloud service because they understand that these things are painful and that these things are important and that these things are easily misunderstood or easily gone wrong and that the consequences of getting them wrong can be very bad. So, as much as they can, Microsoft is trying to take that out of the hands of the individual developer and that’s why.
So, they have the capability of doing the same thing and they both do issue TLS certificates now. So, we’ve talked in the past about how the public cloud between those three providers, those three big providers is this incredible battle – this market share battle – and you gotta imagine that the others are gonna take note of this and something similar may go onto their roadmaps as well.

