Secure Authenticode key on a build server

Question

I'm trying to figure out how best to set up Authenticode signing at my workplace. The security implications are stressing me out.

My initial thought is that the person who controls the key should install it to the build server and secure it so that only the build account can access it.

This seems reasonably secure, but it actually isn't. Yes, you can't steal the cert at this point, but if you can create a build you can get the build account to sign any binary.

Does anyone who is familiar with the process give me some pointers?

Answer 1

Indeed, if the key is available for use in build account, it's available for admin's account and it can be used to sign other file. Whatever you give to others' posession is not yours anymore. If you can't secure the server from other people access, then you don't control the server fully, and this leaves a chance for misuse. Frankly speaking, I can't imagine a single way (other than move signing to some other trusted system) to protect the key from misuse. Even when the key can't be extracted or copied (say it's put to cryptotoken), it still can be used in some way.