How can I programmatically get the company information used to digitally sign an assembly in .NET?
As a simple security measure, I previously checked the digital signature of a downloaded service pack for my program against its public key to make sure it originated from me. However, since I am using cheap code signing certificates (Tucows), I cannot renew the existing certificate and therefore the keys change every time I need to renew.
Hence, a more reliable means would be to check the organization information embedded in the signed assembly (which is displayed in the UAC dialog) against my well-known organization string, as this will remain the same.
Does anyone know how to get this information from a digitally signed assembly?
a source to share
Isn't it enough to just check that the assembly is strongly named using your key? Authenticode mainly benefits the end user who can identify who you are, who you say (thanks to the efforts of the authority of cert.). In my opinion, in your situation, there is no additional security in the COA through a simple strong name.
My guess is that the strong name is much easier to check and you don't have to worry about your key changing.
a source to share
Assuming the assembly is signed using Authenticode technology and X.509 certificates (not just strong name), you need code (or component) for Authenticode to retrieve the certificate and verify it. Then you will find the name of the organization in one of the fields of the SubjectName certificate or SubjectRDN record.
In the PKIBlackbox package, we provide an authentication reader class and a certificate manipulation class .
a source to share