Certificates

A certificate is a signature that can be traced back to its original issuer's identity. By signing an application with your own certificate, you guarantee to its users that the application engages in no malicious behavior and can be trusted.

Certificates are available on three levels for different purposes:

Figure 28: Which certificate to use?

• Self-signed certificate

  A self-signed certificate is generated by the developer and usually used for testing purposes, although a package in public distribution can be signed in this manner as well. The drawback of a self-signed certificate is that during installation, the device presents a warning dialog that the application has not been signed in an 'official' manner.

  A self-signed certificate can only give access to the following capabilities:

  Capability	Function
  LocalServices	Grants access to local network services that usually do not incur a cost (e.g. Bluetooth, infra-red)
  Location	Grants access to data giving the location of the phone
  NetworkServices	Grants access to remote network services that may incur a cost (e.g. voice calls, SMS)
  UserEnvironment	Grants read access to data that is confidential to the phone user.
  ReadUserData	Grants access to live confidential information about the user and their immediate environment (e.g. audio, video or biometric data)
  WriteUserData	Grants write access to data that is confidential to the phone user.

• Developer certificate

  When an application requires more than the six basic capabilities listed above, it needs to be signed with a developer certificate. Developer certificates are issued and managed by Symbian Signed. To apply for a developer certificate, follow the instructions in the document Symbian Developer Certificate Request Process.

  Developer certificates cannot be used for signing commercial releases of the applications. They are meant for development purposes only.

• Symbian Signed certificate

  Symbian Signed certificates are mandatory for applications that are intended for public distribution and require an extended set of capabilities. Symbian Signed performs a set of test cases to the application before it can be signing. The Symbian Signed certification process costs a few hundred euros/dollars.

For more information about certification, see document Freeware Opportunities for S60 and Series 80 Developers at Forum Nokia.