Software Engineering Stack Exchange is a question and answer site for professionals, academics, and students working within the systems development life cycle. It only takes a minute to sign up.
Sign up to join this community
In order to sign an application for the Apple App Store, we need to create a certificate by saving a certificate request file from keychain and then upload it to the Apple store.
I was wondering, what does this certificate request file contain?
Does the certificate contain any information (like a finger print) about the OS or hardware?
No, there's no personal information or information about your hardware configuration stored within the CSR (certificate signing request). The CSR is part of an asymmetric encryption key, ie. it is the public portion of a public and private key.
Essentially, both keys are just a bunch of random* numbers that enable Public key encryption.
Have a look at this SO question for additional details.
* No, the numbers aren't truly 'random' but it's a good enough description for this question.
A certificate signing request contains information about the distinguished name of the individual who generated it along with the public key.
The standard form of the request that on sees is a Base64 encoded request that contains the above mentioned distinguished name, the public key and the method that was used to generate the public key.
The RSA public (and private) key does not contain any information about your hardware.
The excerpt below comes from an article on Apple's Developer website about code signing:
To enable signed code to fulfill these purposes, a code signature consists of three parts:
- A seal, which is a collection of checksums or hashes of the various parts of the code, such as the identifier, the Info.plist, the main executable, the resource files, and so on. The seal can be used to detect alterations to the code and to the app identifier.
- A digital signature, which signs the seal to guarantee its integrity. The signature includes information that can be used to determine who signed the code and whether the signature is valid.
- A unique identifier, which can be used to identify the code or to determine to which groups or categories the code belongs. This identifier can be derived from the contents of the Info.plist for the app, or can be provided explicitly by the signer.
As for more information, check out this post on why and how to do code signing from Adam Eberbach, an experienced full-time IOS developer: http://www.raywenderlich.com/2915/ios-code-signing-under-the-hood.
