When I install my application on my computer I get a warning that the publisher is not verified. How can I change that? or do I need to worry about that when I distribute my application?
The application is written in Visual Studio 2008 with VB.NET
On the Project Properties window, go to the Signing tab. Create/Import certificates and sign the manifests and/or assembly.
You can find more information here, with helpful links at the "See Also" section.
You can use the signtool command line program to sign exe files or msi files. I believe you might need a certificate from an official authority to change the UAC messages.
Related
Greetings good people of stackoverflow.
I have made an msi-installer with WIX and some custom actions built in C#. The main reason for this installer is that the original software package we want to silently install, doesn’t support this in a good way. To circumvent this issue, I extracted the files needed and put them in my own installer.
The software itself is an HMI/SCADA system containing two main types: Server and client runtimes. My focus is on the client side. This is needed to run projects made in the SCADA “IDE”.
So, my package installs the client-side SCADA, the project and my custom action creates an ODBC-connection.
The client runtime installs in the exact folders as it would have been with the original MSI i.e in C:\ProgamFiles. The SCADA client project installs in C:\ProgramData. The custom action creates an ODBC using C# and Registry.LocalMachine. The custom action also makes some changes to some textfiles in the SCADA client project in ProgramData.
The installation works well when it’s running from command prompt with “msiexec /quiet /i “Installerproject.msi”.
With all this in mind, there is one customer with an IT department that uses this package to roll out on its user’s machines. They get stuck in SmartScreen and must manually push “Run anyway”. The message is:
Microsoft Defender SmartScreen prevented an unrecognised app from
starting, Running this app might put your PC at risk.
App: “My installer name”
Publisher: Unknown.
I’ve tried use this installer on virtual machines and only with command prompt, and it doesn’t show this message.
I’m not sure what to do. Is the only way to use EV certs? Even if the original software is issued as a trusted publisher? What’s your take on this? I really need some guidance.
Best regards
Thanks Scaler for the nudge to the right direction. I have signed the installer with a CodeSigning certificate.
This is my first time trying to deploy a VSTO add-in to a user's system, and I am running into a security barrier. The add-in was built in Visual Studio 2019 Community Edition and is meant to integrate with Microsoft Excel. The user runs Office 365.
On running Setup.exe, user receives the initial confirmation prompt and clicks "Install." A progress bar briefly appears and runs about 25% of the way, then an error message pops up: "Customized functionality in this application will not work because the certificate used to sign the deployment manifest for [the add-in] or its location is not trusted."
I understand that Microsoft would like me to pay for a signing certificate, but I am hoping to get this to work while avoiding that expense.
This article from Microsoft describes the use of a digital certificate as "an optional step": ClickOnce and Authenticode. This article states that an alternative route is for the user to click the "ClickOnce trust prompt" during installation: Grant trust to Office solutions. But as far as I understand the process, it is halted before it even gets to the ClickOnce trust prompt, so the user never gets that option.
For comparison, the user ran the installation on an older system. On that system he received the ClickOnce prompt, approved the software, and the installation ran successfully to the end. This indicates very strongly that the problem on the newer system is a security setting.
I instructed the user to open Excel and go to Options > Trust Center > Trust Center Settings > Add-Ins and remove the check mark from "Require Application Add-Ins to be signed by Trusted Publisher." There was no check mark to begin with, so that setting was not the issue.
I have instructed the user to go to the command prompt and clean out any remnants of the failed install with rundll32 dfshim CleanOnlineAppCache before each new installation attempt.
I'm at a loss as to where to look next. Any help would be much appreciated.
One relatively easy workaround: you pack the "publish" folder as ZIP file, disable any online checks or deployments (in the project settings, select to publish locally, not to a website. Installing from a website or auto-update won't work without normal certificate). Then give your user that ZIP. User downloads that ZIP, then right-click the ZIP file and checks "Unblock". Then unzips and installs normally. Now any certificate should do. This applies if your user downloads your file from the internet.
So the idea is very simple: Just tell your user to click "Unblock" checkbox before extracting files from the ZIP archive you have sent and running them.
Another solution, you simply tell the user's system to trust your "self-signed" developer's certificate (add your certificate to "Trusted Publishers" store on the user computer). For that you need admin rights. Please note that user's admins probably won't like this idea, unless you and your user work in the same organization. Here are the instructions: https://learn.microsoft.com/en-us/skype-sdk/sdn/articles/installing-the-trusted-root-certificate
The best and easiest of course would be if you buy a normal code signing certificate. They are not that expensive, you can get one from COMODO (SectiGo) for example for something like $70/year though their resellers.
On the target machine. you need to install and trust the certificate used to sign your addin (see Signing tab of your project options)
What is required for the certification process, is it a quick process? Are they certifying me/ my business or the code??
It is a quick process for the process:
Sign with valid certificate when publishing.
Add the publisher into Trusted Publisher before installing when Macro Settings is a high security level.
Finish installing.
You can obtain a certificate for code signing in one of three ways:
Purchase one from a certificate vendor.
Receive one from a group in your organization responsible for creating digital certificates.
Generate your own certificate with MakeCert.exe, which is included with the Windows Software Development Kit (SDK).
I was recently given a VB.NET project for fixing some bugs and creating an installer for it. I was told to use Install Shield LE.
All went well with creating the install script but Windows 8 is giving me a smart screen warning when downloading the application from a web site and trying to install it.
I am aware of Windows 8 policy where popular applications get more "trust points" and become popular but the application is targeted for a fairly small audience of people therefore we can not rely on this option. Even more, people without proper knowledge would be repelled by the warning message and that could cause MS to never raise the trust for the application.
My question is, do I have to sign both - the application and the installer with a certificate? If so how do I sign the installer, as there is a signing tab for the project but I can't find one for the installer.
Bonus points if anyone can tell me if acquiring a proper certificate will remove the warning message telling this isn't a commonly downloaded file and might be dangerous from chrome/IE when downloading the application. There are many threads about this, I know, but most of them suggest adding the site to webmaster tools but that hasn't helped and we're still receiving the message
Thanks.
If I have read your post correctly then you are talking about an application as opposed to a website, and for that you would need a code signing certificate. Certificates that sign websites are different so first and foremost decide what it is that you are producing and want to sign.
Having decided that then you need to decide who you will use to supply your certificate. Typical sources would be VeriSign, Thwaite or Globalsign to name but three. All charge different prices but essentially do the same thing.
Once you have the certificate then the installer that you use to build your application signs the code files you select and the actual installer (msi or exe) itself.
That should eliminate the message that you now see warning people about potentially dangerous files that they are about to download.
I cannot stress enough however that you need to be clear about which type of certificate you need BEFORE you go ahead and buy one. I think from your description you are talking about a code signing certificate but do check first.
Following CAB forum regulation you will need to have an Extended Validation code signing in order to bypass the smart screen filter.
Extended Validation code signing will establish immediate trust with the machine, as you go through a more stringent validation process to obtain it! (or at least that's the rationale behind it!)
I think you can get an extended validation code signing either from SYmantec or GLobalsign.
I am trying to deploy some MVC4 web apps with secure bindings on Windows Server 2008R2 and WiX 3.6 (stable)
I am desperately trying to get this to work without resorting to writing a follow-up powershell script or my own custom action.
The WiX iis:Certificate extension wants to install the certificate for me first before I can use it. That's not going to work in a production environment. The certificate is not going to be available to the installer at any time in .cer or .pfx form. It will already be deployed on the target machine in the localMachine/my store where you'd normally go when installing manually with the IIS7 snap-in. I will want the installer to be able to reference it by supplying any of the following: thumbprint, Friendly id or perhaps find it matching the web site host header binding pattern.
Is there any way of referencing a pre-installed certificate in WiX script without having the original .pfx file and password at build time or install time? (I got these last two scenarios working fine in test, but it isn't what the client wants).
Thanks.
I had a similar requirement to you so I wrote a post about it:
http://manyrootsofallevilrants.blogspot.co.uk/2013/07/assign-certificate-set-https-binding.html
Well it's been a while since I posted this.
Since then, I got on with it and wrote a custom action in C# to do the heavy lifting. Powershell didn't seem to give me the control of failure modes that I needed.
I can't post the code - since it belongs to my client, but I can say that I used Microsoft.Web.Administration in a similar way to that described in this question: Programatically Import Cert Into IIS. I hope that helps. It wasn't the answer I wanted, but it did solve the problem.
I am developing an AIR application. I am exporting the release build as native installer by signing it with a digital certificate that was bought from TC Trust Center. Following flow happens with the setup.exe created.
This setup.exe is now uploaded to a host to enable users to download the setup file.
A user downloads this using browser and double clicks on the downloaded setup.exe.
Windows shows up a security warning pop up and states that the publisher is unknown.
After clicking continue, the AIR installer shows up the correct publisher name
And when the program is installed the control panel also shows up the correct publisher name.
I would like to know why is Windows security warning unable to detect the publisher name? And how can this issue be resolved. Kindly help. Thanks in advance :)
Publisher name must not necessarily be taken from the signature. In fact, in Control Panel it's taken from the registry record rather than from the signature, so this is not a proof.
Most likely you needed to include intermediate CA certificates with the signature, and the tool didn't do this automatically.
Open Explorer, and right-click on your setup.exe and invoke Properties dialog. If the signature is present and recognized, Digital Signature tab will appear in the properties. This doesn't mean that the signature is valid, though. You need to go to this Tab and check the certificates used for signing, their status and the certificate chain. The certificate chain must be complete and lead up to recognized root or trusted CA certificate (recognized means that Windows has it in it's trust list).