I am trying to create an unattended Silent install for HP ALM CLient Add for Citrix environment.
I am facing issues, when trying to suppress the "Install" customization window, which appears when we launch Excel. Couldn't able to suppress the window. Tried to install using below command but unsuccessful
VSTOInstaller.exe /Install \C:\Path\Exceladdin.vsto /Silent
I tried installing the certificate first by adding it to TRUSTEDPUBLISHERS then i tried to install, still no success.
Can someone help on this and anyone worked on this for Citrix environment.
If you want to use trust, the entire hierarchy for the public certificate must be trusted as well. Look at the Certification Path tab for the certificate you're using, and put the root certificate into the Trusted Root Certificate Authorities store, and anything between into the Intermediate Certification Authorities store. I know there's an MDSN page for this somewhere (or else I would not have this information), but I can't find it. It's probably somewhere under Granting Trust to Office Solutions.
You could also use inclusion lists, or install it to the Program Files folder where Full Trust is automatically granted (because admin is required to put it there).
Related
I am trying to get the signing working with TFS 2010. I already imported the .pfx File in the Personal Store for the Build Computer. I read somewhere i have to do this for the account the build service is running under. But i don't know how i can do this for "NetworkService", which is the account under which my build service is running.
The error message i am getting of MSBuild:
Unable to find manifest signing certificate in the certificate store.
I read somewhere i have to use the sn -i mycert.pfx VS_XXX but i have no idea where to get the VS_XXX from?
The only working solution for me seems to use another user account for this. In my case I needed a valid domain user. Because the user needs to have the correct rights for the team foundation server.
I logged in with this user on the build machine and added the certificate to my certificates (you should be able to do this by double clicking it).
Microsoft's SmartScreen Filter under Windows 8 is a small developer's worst nightmare.
While I realize the benefits to end users and the effectiveness at stopping malicious programs from installing themselves on end users' computers, I and many other developers would rather not pay the fees for annual renewal of a Code Signing Certificate or, even worse, an EV Code Signing Certificate. Also, when products developed for use in-house are signed with a trusted certificate from an internal CA, stored in the Trusted Publishers store, they still fall prey to the filter's overzealous behavior.
Developers and Administrators used to be able to disable the warnings and prompts by installing a publisher's Code Signing Certificate in the Trusted Publishers store. Creative developers could install their self-signed Code Signing Certificate there when they install a pre-requisite signed and timestamped with a paid-for Authenticode Code Signing Certificate. After that, programs signed by the publisher would be trusted and would not trip the SmartScreen Filter alarms. Essentially, once trusted, a publisher was free from the recurring fees.
The recent changes to the SmartScreen Filter (and its inclusion as an OS "feature" in Windows 8) make it clear Microsoft wants you to buy a code signing certificate instead of creatively working around the problem they've created for you. Has anyone discovered a new method to trust publishers who use their self-signed Code Signing Certificates by default (i.e., not showing the prompts)? Short of turning off the filter completely, what can end users do to let the SmartScreen Filter know to always trust a Self-Signed certificate?
Please note that purchasing a Code Signing Certificate is not an answer to this question. I'm looking for a way to tell SmartScreen Filter to trust a publisher that does not purchase certificates from an outside source, but instead issues their own for use inside their organization.
UPDATE: I think I might have found a workaround! From MSDN, SmartScreen Filter can be disabled on Windows 8 and Internet Explorer 10 for sites listed as Trusted Sites. If someone could verify that this method works for setup programs downloaded and run from a Trusted Site in Windows 8, that would be greatly appreciated and would help a lot of ISV's and in-house development teams. It would also be the workaround needed to answer this question. Trusted Sites can be configured by group policy, so it would be simple from there.
Programmatically, turning off SmartScreen Filter for the Trusted Sites Zone can be achieved by setting either HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2301 for the machine or HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2301 for the user to 0, and adding the site to be trusted to the Trusted Sites Zone can be done as shown in this question.
Could someone please verify that my proposed workaround functions on Windows 8 for an unsigned or self-signed executable downloaded from a Trusted Site? I'm not using Windows 8 myself, having spent my OS upgrade budget on certificate fees.
To quote from MSDN's website:
Detractors may claim that SmartScreen is “forcing” developers to spend
money on certificates. It should be stressed that EV code signing
certificates are not required to build or maintain reputation with
SmartScreen. Files signed with standard code signing certificates and
even unsigned files continue to build reputation as they have since
Application Reputation was introduced in IE9 last year. However, the
presence of an EV code signing certificate is a strong indicator that
the file was signed by an entity that has passed a rigorous validation
process and was signed with hardware which allows our systems to
establish reputation for that entity more quickly than unsigned or
non-EV code signed programs.
In other words, EV (paid) validation is just one factor in a large algorithm that determines whether the SmartScreen warning is displayed or not. If you have a lot of people that download your program, or if your program download link has not changed in a while, with some work you can get your program not to show the warning. Also, by digitally signing your code, you can increase your Appication Reputation. This is straight from Microsoft's webpage on the topic.
Using a 90 day trial of Windows 8 from Microsoft, I've been able to verify that my workaround does indeed work. If you want to pay for a code signing certificate once and only once instead of paying annual fees, this method should work for you as well, but I can't make any guarantees. My solution is per-machine, but should be easy to convert to work per-user.
This is my solution:
Set up your own certificate infrastructure.
Publish copies of your root CA certificate, any intermediate CA certificates issued by your root, and any code signing certificates issued by your intermediate CA's to your website as .cer files.
Install an SSL certificate on your website that was issued by your Root CA.
Create an installer/downloader application that performs the following tasks:
Installs the root CA certificate (from your website, step 2) into the Trusted Root Certification Authorities store for the end user's machine.
Disables SmartScreen Filter for the Trusted Sites internet zone by setting HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2!2301 to 0.
Adds your website to the zone map by adding the registry key(s) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\yourdomain.com\yoursubdomain.
Maps your domain to the Trusted Sites zone by creating a DWORD named https with a value of 2 in the key created in the previous step.
Purchase a code signing certificate from a member of Microsoft's Trusted Root program, preferably an EV certificate.
Before your purchase, make sure the certificate and timestamping scheme used by the CA for your code signing certificate will not result in OID's 1.3.6.1.4.1.311.10.3.13 or 1.3.6.1.4.1.311.10.3.14, as these would make the signature expire when the certificate expires, whether it's timestamped or not.
Sign and timestamp your downloader/installer with the certificate purchased in step 5. Verify the absence of lifetime limitations on the signature. If everything is ok, you can put your purchased code signing certificate in a safe place and lock it away.
Publish your downloader/installer program to your website. Make it a pre-requisite download for all your products.
From this point on, you can use code signing certificates (and other certificates, for that matter) issued by your own internal certificate authorities without SmartScreen Filter being a nuisance.
The worst warning I’ve received using this method so far has been “This type of file could harm your computer.” That's the typical "You're downloading an executable file!" warning. It doesn’t hide the Run option and does not appear for ClickOnce deployments using the bootstrap webpage generated by clicking “Publish” in VS2010.
Thanks for all the comments and links.
I have found a really easy way to bypass the filter even without admin privileges. What you need to do is:
Open notepad
Type in the following line: #%*
Save the file as "SkipSmartScreen.bat" (yes, with the quotes) in the same folder as your app. You can rename the batch file later
To launch your app, drag your exe on to the batch file
This will then bypass smartscreen filter.
Tested on Windows 10 Home, Pro, and Enterprise, and Windows 8 Pro.
How it works:
# - This is just for looks, it hides the name of the command being executed
%* - This expands to all command line arguments passed (e.g. the file you dropped on the batch file
The whole thing: It executes the file through the batch file as if it was a line in the batch file. For some reason, Windows does not do any check on files which are executed from a batch file.
Here is good explanation how to turn off the SmartScreen:
- Windows SmartScreen - Turn On or Off in Windows 8
- Uncheck option in Folder Options
What I used and what worked for me? It was "option one" from first link:
Open the Control Panel (icons view), and click/tap on the Action Center icon.
In the left pane of Action Center, click/tap on the Change Windows SmartScreen settings link.
If prompted by UAC, then click/tap on Yes.
Select (dot) the option for how you want Windows SmartScreen to handle unrecognized programs, then click/tap on OK.
NOTE: The default option is to Get administrator approval before running an unrecognized app from the internet.
When finished, you can close the Action Center if you like.
I hope that this is what you were looking for. :)
Old question but I recently had the same issue where I needed to download a small installation package down to a user's pc for them to execute.
But as always SmartScreen was blocking the download...
A workaround that I discovered is to package your installer file in a .zip (or the likes) and then have the user download this compressed file and execute the installer within.
This is at least the "prettiest" solution that I had to use in my scenario.
This method saves you from having any kind of certificates assigned to your files. You just need your users to trust you, but this will bypass the SmartScreen Filter.
I hope this can be used as a workaround for your issue.
Having trouble with ClickOnce manifests and our build server.
We have a .p12 code signing certificate (which is the same as a .pfx). I can assign this certificate on a developer machine in:
Visual Studio->Project->Properties->Signing->Select from file, then
enter the password for the certificate.
Everything builds/publishes fine locally.
However when checking in all files to our TFS build server the automatic build generates this error:
Cannot import the following key file: . The key file may be password
protected. To correct this, try to import the certificate again or
import the certificate manually into the current user’s personal
certificate store.
Is there a way to pass in the password to the build definition so that the built assembly is signed?
Also each developer who does a 'get latest' currently needs to re-sign the assembly with the correct password each time, is there a better way?
Note:
The build server does not have Visual Studio.
I have tried manually importing the certificate, under the account that the build runs on, to the personal certificates folder.
This is what fixed my problem:
1 ) Logon as the TFS build controller account and install the certificates manually there.
2) With some older certificates there can be a problem with the root authorisation (chaining), in this case download the root certificate from your certificate issuer, and possibly an intermediate certificate.
3) Make sure the computer/virtual machine that is running the service "Visual Studio Team Foundation Build Service Host" is running under an account that has the certificates installed. In our case this is the same as the build controller account.
I have a certificate in which i need read permissions of a certificate of a very specific group when installing an application. I am using the wix installer to install the app and certificate but for the life of me, i cannot find a way to provide the correct group. it needs to be in the local machine store but it seems that when i install the certificate with wix it automatically gives permissions r:w to administrators, msiserver, and system and no rights to owner rights.
I need a 5th group to be defined in there with read permission and must be able to do this on install as manual configuration is out of the question.
is there a way to do this with wix?
It seems that this is not easy, but it's doable: Modifying security on installed certificates
Perhaps you should try using a custom action to install the certificate instead of the WiX built-in support. This way maybe it will use the default permissions which work for you.
I have registered for the Safari Development Program and have a valid Apple ID. I've followed all the steps given by Apple.
The problem is that Windows XP (Service Pack 2) does not recognize the command 'certreq', whereas the instructions said it would work on any Windows machine.
However, the command 'certreq' was working on Windows Vista on the machine of my co-worker's, I downloaded the certificate (the .cer file) and installed it and Safari detected it.
However, I don't have Windows Vista.
I installed Windows 7 now on my machine, the command 'certreq' works and I have the Safari Extension Certificate (the .cer file) but when I open Safari's Extension Builder, my certificate does not appear there.
I entered mmc in Start --> Run and checked if the certificate was installed there. It was in the 'Other People' but not in 'Personal'.
Even on Internet Explorer 7+, when I go to Tools --> Internet Options --> Content (Tab) --> Certificates, the certificate is not there in the Personal tab, (WHEREAS IT GOT INSTALLED IN THE PERSONAL FOLDER AUTOMATICALLY IN WINDOWS VISTA). I tried importing the certificate (the .cer file) into the Peronal folder, the import is successful but still neither does it appear in the personal folder nor does Safari recognize/detect it when I go to the Extension Builder.
ANY HELP?!
I need to make an extension for my office project and the deadline is approaching. I really need to get it done.
Thanks a million in anticipation.
I was facing the similar problem. After struggling a lot the following worked for me:
Install (Windows Server 2003 service pack 2) Administration Tools pack as shown on “Generate a Certificate Signing Request” screen shown by Safari Extension Certificate assistant: http://www.microsoft.com/download/en/confirmation.aspx?id=6315
Install IIS resource kit for SelfSSL- http://www.microsoft.com/download/en/confirmation.aspx?id=17275
As indicated by Safari Extension certificate assistant, save the following as certreq.txt --https://devimages.apple.com.edgekey.net/safari/files/certreq.txt
Run cmd, and then change directory to where you saved certreq.txt
On command prompt type: certreq –new certreq.txt newcsr.pem
Press Continue on the Safari Assistant screen, and upload this newcsr.pem
It will generate a certificate that you need to install by double-clicking on the installed file.
You are done!
Go to Develop (in Safari menu bar)>> Show Extension Builder >> Click + and select new extension.
By generating the cert request on another machine you don't have the private key associated with the cert on your own. Generate a cert request on your Win7 machine now, go get a new cert from Apple, and it should work fine.
To use the certificate on Windows, I needed to click on the file that was created (safari_identity.cer). That installed the certificate in the Windows Certificate store. Rrun certmgr.msc and look under the Personal..Certificates folder to see it. My installed cert looked something like this in the Microsoft Management Console for Certificates: "Safari Developer: (xxxxxxxxxxx) me#zzz.com".
this is an answer for Mac users who may be experiencing this problem.
Once you install your certificate, double click it, go under Trust, and set Always Trust for When using this certificate. Your certificate should work then.
It's got something to do with the private key - On me Vista it says CertReq: Request Created and it installs fine, but then on Windows 7 it just creates the file and when you look at the info before/after install it doesn't display that it is associated with the private key on the computer. Very confused I am.
when you enter something like "certmgr.msc" in the run command in window, you will get to see something like this:
So using the certificate consists of the following steps:
first save the file and run the command in cmdd.exe as directed in the developer certificate generator in extension certificate developer.
when you are done, check the certmgr [shown above in the image] and see a certificate named safari developer installed somewhere near Certificate Enrollment Requests. cut the certificate and paste one copy inside trusted root certification Authorities and another inside Personal.
then generate the csr file and install the file inside Personal folder and trusted root certification Authorities folder.
extension builder will recognize the certificate.
Best of luck.
If the certificate has an incomplete chain, it may be necessary to install the certificates on Apple's certificate page . I believe "Worldwide Developer Relations" (and possibly the 2 root certificates) are necessary for Safari Development.