Code signing addresses the need for users to trust the code they download and then load into their computers memory. After all, without knowing who provided the software, or whether it was altered after being distributed, malicious code could be added to a component and attack a user's computer.

Digital certificates can be used to sign the code and to authenticate that code hasn't been tampered with and that it is indeed the file distributed by its creator. The digital certificate consists of a set of credentials for verifying identity. The certificate is issued by a certification authority and contains a name, serial number, expiration date, copy of the certificate holder's public key, and a digital signature belonging to the certificate authority. The elements of the certificate are used to guarantee that the file is valid.

As with any process reliant on trust, code signing has its positive and negative aspects. In the sections that follow, we discuss these issues and show how the process of code signing works.