Đối với các điều khiển ActiveX phân phối trong thẩm định mã máy có thể được sử dụng để thực thi một quyết định đơn giản: hoặc tải về kiểm soát hoặc không tải về kiểm soát. Những chữ ký Authenticode chỉ được xác nhận khi kiểm soát được tải về từ Internet. | Securing Windows NT 2000 Servers for the Internet The CSW s second screen Figure allows the developer to specify what program will be signed and what information will be displayed on the program s certificate when the code is validated. It contains a URL that can be clicked on to provide more information about the program. The full name and URL are displayed on the program s certificate when its digital signature is checked. Figure . The Code Signing Wizard s second window Next the developer specifies which key should be used to sign the program what credentials are used for the key and what cryptographic digest algorithm is used for the signature see Figure . The information is then verified see Figure . Figure . The Code Signing Wizard s third window page 128 Securing Windows NT 2000 Servers for the Internet Figure . The fourth step is to validate all of the information that will be used to sign the binary The lokwng n oimdier. I I zc- o ngn Jiou projam. Ffeasa IBMBH Ihis sasful . Pragrmt izr hid0Ci Piogr n name lítìdũWí Notepad appicatxin lie Ptogani Inta HHpc own Cir. Innlids E at lu nep iSiihefspc Pnvaleke E Jijejjt clas5liiiik ClJJpIo providci Mi . JI Bae Crjjj ojiapl-tc Pl wte vl 0 Eiack I Hajj I Carwol Finally the developer signs the executable see Figure . Figure . The fifth and sixth panels perform the actual signature Verifying Authenticode Signatures Currently Authenticode signatures can only be verified by programs that are developed with the Microsoft ActiveX Software Developer s Toolkit. The ActiveX SDK includes a program called chktrust that allows users to check the certificate on an executable. If the program being checked is signed chktrust displays the certificate and asks the user if he wishes to trust it. If the program being checked is not signed or if the user chooses not to trust it the chktrust program returns an error code. The chktrust program has these options C chktrust
