AIR Does NOT Require Certificate for Full API
After Ted posted his AIR entry on his blog and talked about the various great things about the runtime, he also mentioned that it is important to purchase a signed certificate from companies such as Thawte in order to get the "greatly expanded APIs", I immediately pinged Ryan to confirm this since Ted was not immediately available.
Shocked, Ryan went to check and reported back that it was not the case. Since then, I noticed that the misinformation has been removed from Ted's blog.
The actual question I posed to Ryan was if he thought the $300 certificate cost from Thawte would discourage the development of open source and free applications. He didn't think so due to the ability to self-sign your own applications, however, at the cost of them being labeled as "UNVERIFIED" when the user installs them. Is there a way around this? Such as a certificate for open source applications to encourage this ever-increasingly popular movement?
The certificate is evaluated at the system level so unless the user's OS recognizes the certificate (e.g. the user loads a certificate into the certificate store if it does not exist) the cert will not be recognized and will therefore be unverified. Thawte and Verisign are apparently the only two cert authorities which are readily recognized by Win OS X (see "How To Get A Certificate" para. 1)
From my Win box:
The certificate store
There are four basic sources for the certificates found in the certificate stores on your computer:
The certificate is included with your installation of Windows XP and came on the Windows XP CD.
You use an application such as an Internet browser to engage in a SSL session, during which certificates are stored on your computer after establishment of trust.
You explicitly choose to accept a certificate, as when you install software or receive an encrypted or digitally signed e-mail from others.
You request a certificate from a certification authority, such as a certificate needed to access specific organizational resources.
It's not uncommon to ask your user to install the security certificate, I am thinking that this would be the way to go on a budget. Here is a list from the Open Directory: http://tinyurl.com/3e4opt
And yes a certificate is worth it. :)
Regards and Apologies,
Ted :)