Newbie needs help understanding code signing and certificates

[ppcinfo]

I'm a Pocket PC developer venturing into the area of Smartphone application development. I've been reading numerous online articles on code signing, certificates, priviledge and unpriviledge, etc. and my head is just spinning! I understand that without certain "priviledges" my application with either not execute or won't be allowed to call certain API routines.

Can some explain in basic terms what I need to do to get my application installed and runnable on a WM 5 OS Smartphone device?

I need clear, basic answers to questions like:

- What kind of code signing do I need?
- Where can I get certificates, and how much do they cost?
- Do I purchase a single certificate for my company, which I can use to sign all my deployed applications?
- Does this certificate reside on a 3rd-party server (e.g., Verisign or GeoTrust)?
- Do I need to upload my .exe, dll, etc. files to the 3rd-party server for signing?

Although I've read through several Microsoft articles talking about Smartphone security and code signing, how a developer actually does the process and the cost involved is very unclear to me. Any help in understanding this would be greatly appreciated.

Having to go through all this code signing business will certainly discourage novice developers from creating freeware for Smartphone users.

Thanks,

ppcinfo

[Birdsoft]

For the most part you do not need to have anything signed, unless you need to use privelaged APIs, which you won't for a lot of software. It does limit your markets by a couple of carriers(if the users on those carreirs are not savvy enough to software unlock their device).

I am now finally going thru the process of getting a signed certificate and my main products have been out and been bestsellers for months. You have to become verified using GeoTrust or Verisign(a process if you are a small company), and then I believe I recieve a key on a USB device that I have to sign all my app and dll files with, and then send them in to be signed again by the company. It is like $300 for 10 "signs"(that have to be used in 1 year) so if you are doing a lot of updates to the software, it is very cost prohibitive to do it, so I decided to wait until now. Though I plan to continue to do frequent updates, so Im not sure how Im going to work this.