Securing Integration Services (Digital Certificate) – Part 2
This is part 2 of the Securing Integration Services series. In this article I will be showing you how to Sign a SSIS package(s) with a digital certificate.
Digital certificate can be used alone or with other setting to protect SSIS package from loading and running in unauthorized location.
Before sign your package with certificate, make sure you have the following.
1. Get certificate from a commercial certification authority that issues digital certificates.
2. Create or obtain a private key to associate with the certificate, and store this private key on the local computer.
Else, we can create our own certificate for testing purposes only. The Certificate Creation Tool (Makecert.exe). We need to install Window SDK to get this tool. Download here.
Using certificate creation tool MakeCert.exe. More information here.
We can see the certificates in the current environment using Certmgr.exe
I have created my test certificates to sign SSIS packages using the following commands
Create Root Certificate
makecert -n “CN=SSIS Certificate” -a sha1 -eku 184.108.40.206.220.127.116.11.3 -r -sv root.pvk root.cer -ss Root -len 1024 -sr localMachine
Create Client Certificate
makecert -pe -n “CN=SSIS Code Signing Certificate” -ss MY -a sha1 -eku 18.104.22.168.22.214.171.124.3 -iv root.pvk -ic root.cer
Sign the certificate with SSIS
1. Select Digital Signing from SSIS menu in BIDS.
2. Click Sign button to select certificate.
3. Choose certificate and click ok.
4. We can remove the selected by clicking remove button and click ok to complete the process.
We can view the certificates using certmgr.exe from the Windows SDK
Check this option in BIDS
Thanks for Reading.