This is my first time trying to deploy a VSTO add-in to a user's system, and I am running into a security barrier. The add-in was built in Visual Studio 2019 Community Edition and is meant to integrate with Microsoft Excel. The user runs Office 365.
On running Setup.exe, user receives the initial confirmation prompt and clicks "Install." A progress bar briefly appears and runs about 25% of the way, then an error message pops up: "Customized functionality in this application will not work because the certificate used to sign the deployment manifest for [the add-in] or its location is not trusted."
I understand that Microsoft would like me to pay for a signing certificate, but I am hoping to get this to work while avoiding that expense.
This article from Microsoft describes the use of a digital certificate as "an optional step": ClickOnce and Authenticode. This article states that an alternative route is for the user to click the "ClickOnce trust prompt" during installation: Grant trust to Office solutions. But as far as I understand the process, it is halted before it even gets to the ClickOnce trust prompt, so the user never gets that option.
For comparison, the user ran the installation on an older system. On that system he received the ClickOnce prompt, approved the software, and the installation ran successfully to the end. This indicates very strongly that the problem on the newer system is a security setting.
I instructed the user to open Excel and go to Options > Trust Center > Trust Center Settings > Add-Ins and remove the check mark from "Require Application Add-Ins to be signed by Trusted Publisher." There was no check mark to begin with, so that setting was not the issue.
I have instructed the user to go to the command prompt and clean out any remnants of the failed install with rundll32 dfshim CleanOnlineAppCache before each new installation attempt.
I'm at a loss as to where to look next. Any help would be much appreciated.
One relatively easy workaround: you pack the "publish" folder as ZIP file, disable any online checks or deployments (in the project settings, select to publish locally, not to a website. Installing from a website or auto-update won't work without normal certificate). Then give your user that ZIP. User downloads that ZIP, then right-click the ZIP file and checks "Unblock". Then unzips and installs normally. Now any certificate should do. This applies if your user downloads your file from the internet.
So the idea is very simple: Just tell your user to click "Unblock" checkbox before extracting files from the ZIP archive you have sent and running them.
Another solution, you simply tell the user's system to trust your "self-signed" developer's certificate (add your certificate to "Trusted Publishers" store on the user computer). For that you need admin rights. Please note that user's admins probably won't like this idea, unless you and your user work in the same organization. Here are the instructions: https://learn.microsoft.com/en-us/skype-sdk/sdn/articles/installing-the-trusted-root-certificate
The best and easiest of course would be if you buy a normal code signing certificate. They are not that expensive, you can get one from COMODO (SectiGo) for example for something like $70/year though their resellers.
On the target machine. you need to install and trust the certificate used to sign your addin (see Signing tab of your project options)
What is required for the certification process, is it a quick process? Are they certifying me/ my business or the code??
It is a quick process for the process:
Sign with valid certificate when publishing.
Add the publisher into Trusted Publisher before installing when Macro Settings is a high security level.
Finish installing.
You can obtain a certificate for code signing in one of three ways:
Purchase one from a certificate vendor.
Receive one from a group in your organization responsible for creating digital certificates.
Generate your own certificate with MakeCert.exe, which is included with the Windows Software Development Kit (SDK).
Related
I'm developing C++ program. I generate a certificate from our PKI Solution configured in our company(Microsoft). I sign my .exe using the certificate(generated). But when I make my file on the server (internet) and download it, I have the problem of displaying SmartScreen.What should I do to make my .exe works well in all computer of our company? Should I buy a certificate to sign my code? Sign my code with root certificate?
I think problem is your application has downloaded a few users and the reputation is unknown to Microsoft
P.S. And you can distribute your program in Microsoft Store
I was recently given a VB.NET project for fixing some bugs and creating an installer for it. I was told to use Install Shield LE.
All went well with creating the install script but Windows 8 is giving me a smart screen warning when downloading the application from a web site and trying to install it.
I am aware of Windows 8 policy where popular applications get more "trust points" and become popular but the application is targeted for a fairly small audience of people therefore we can not rely on this option. Even more, people without proper knowledge would be repelled by the warning message and that could cause MS to never raise the trust for the application.
My question is, do I have to sign both - the application and the installer with a certificate? If so how do I sign the installer, as there is a signing tab for the project but I can't find one for the installer.
Bonus points if anyone can tell me if acquiring a proper certificate will remove the warning message telling this isn't a commonly downloaded file and might be dangerous from chrome/IE when downloading the application. There are many threads about this, I know, but most of them suggest adding the site to webmaster tools but that hasn't helped and we're still receiving the message
Thanks.
If I have read your post correctly then you are talking about an application as opposed to a website, and for that you would need a code signing certificate. Certificates that sign websites are different so first and foremost decide what it is that you are producing and want to sign.
Having decided that then you need to decide who you will use to supply your certificate. Typical sources would be VeriSign, Thwaite or Globalsign to name but three. All charge different prices but essentially do the same thing.
Once you have the certificate then the installer that you use to build your application signs the code files you select and the actual installer (msi or exe) itself.
That should eliminate the message that you now see warning people about potentially dangerous files that they are about to download.
I cannot stress enough however that you need to be clear about which type of certificate you need BEFORE you go ahead and buy one. I think from your description you are talking about a code signing certificate but do check first.
Following CAB forum regulation you will need to have an Extended Validation code signing in order to bypass the smart screen filter.
Extended Validation code signing will establish immediate trust with the machine, as you go through a more stringent validation process to obtain it! (or at least that's the rationale behind it!)
I think you can get an extended validation code signing either from SYmantec or GLobalsign.
I have a autoit script that I am using for automation testing. My autoit script is called from a vb.net file. Dialog box of UAC settings will appear and is stopping the execution of test scripts. Currently I am trying process.startinfo.username and password to give specifically username so it may execute the script. Please guide how can I avoid that UAC during my tests execution.
Either change the script so that it doesn't need to be elevated or launch it from something that is already elevated. You'll need to consent once to elevate the "Something" then you should be ok. You can also use scheduled tasks to launch elevated things, and consent once when setting up the tasks, but not again when the task runs.
THe only way to avoid it is to sign your assembly with a strong key. There are instructions here on How to: Sign an Assembly. You must first purchase a code signing certificate though from a 3rd party. You can also make your own certificate but I am not sure if signing your code with a custom made certificate will make the UAC screen go away. I would try making your own certificate first and signing your assembly and seeing if that fixes the problem. If not, you can purchase a code signing certificate from several places, such as GoDaddy, VeriSign or from Thawte, just to name a few
I am developing an AIR application. I am exporting the release build as native installer by signing it with a digital certificate that was bought from TC Trust Center. Following flow happens with the setup.exe created.
This setup.exe is now uploaded to a host to enable users to download the setup file.
A user downloads this using browser and double clicks on the downloaded setup.exe.
Windows shows up a security warning pop up and states that the publisher is unknown.
After clicking continue, the AIR installer shows up the correct publisher name
And when the program is installed the control panel also shows up the correct publisher name.
I would like to know why is Windows security warning unable to detect the publisher name? And how can this issue be resolved. Kindly help. Thanks in advance :)
Publisher name must not necessarily be taken from the signature. In fact, in Control Panel it's taken from the registry record rather than from the signature, so this is not a proof.
Most likely you needed to include intermediate CA certificates with the signature, and the tool didn't do this automatically.
Open Explorer, and right-click on your setup.exe and invoke Properties dialog. If the signature is present and recognized, Digital Signature tab will appear in the properties. This doesn't mean that the signature is valid, though. You need to go to this Tab and check the certificates used for signing, their status and the certificate chain. The certificate chain must be complete and lead up to recognized root or trusted CA certificate (recognized means that Windows has it in it's trust list).
When I install my application on my computer I get a warning that the publisher is not verified. How can I change that? or do I need to worry about that when I distribute my application?
The application is written in Visual Studio 2008 with VB.NET
On the Project Properties window, go to the Signing tab. Create/Import certificates and sign the manifests and/or assembly.
You can find more information here, with helpful links at the "See Also" section.
You can use the signtool command line program to sign exe files or msi files. I believe you might need a certificate from an official authority to change the UAC messages.