StrataFrame Forum » .NET Forums » General .NET Discussion » Generate Certificate for ClickOnce

Generate Certificate for ClickOnce

Philipp Guntermann — Wed, 14 Jan 2009 10:24:51 GMT

Hi,

i am looking for a Tool to generate non-expireing certificates for clickonce deployment of our applications. All i found so far is some Microsoft command line tool, which explicitly states that the certificates it generates are only for "test" purposes.

Thanks.

RE: Generate Certificate for ClickOnce

Greg McGuffey — Wed, 14 Jan 2009 10:24:51 GMT

LOL :D

Glad the tool worked for you too!

RE: Generate Certificate for ClickOnce

Philipp Guntermann — Tue, 13 Jan 2009 17:19:28 GMT

[quote][b]Ivan George Borges (01/13/2009)[/b][hr][quote]... and it now has a certificate expiring on the 13.01.2059 :D

Have you started worrying about what you are going to do after that? :hehe:[/quote]

worst case scenario:

telling someone that it wasnt my fault :)

best case scenario:

laying on the beach, enjoying the cocktails -and the girls who get them to me :w00t:

RE: Generate Certificate for ClickOnce

Ivan George Borges — Tue, 13 Jan 2009 16:03:09 GMT

[quote]... and it now has a certificate expiring on the 13.01.2059 :D

Have you started worrying about what you are going to do after that? :hehe:

RE: Generate Certificate for ClickOnce

Greg McGuffey — Tue, 13 Jan 2009 15:17:18 GMT

Cool! This is a must have when using ClickOnce. Your smart to figure this out early instead of suddenly getting a ton of support calls because the app won't install anymore! :pinch:

RE: Generate Certificate for ClickOnce

Philipp Guntermann — Tue, 13 Jan 2009 11:52:40 GMT

Hi Greg,

i have now tried this at home. I installed VC++ Express and downloaded the Renewcert Project from the URL you linked. i then changed the code to add 50 years instead of 5 and compiled it.

It really works :D Made a little test c# solution and it now has a certificate expiring on the 13.01.2059 :D

Many thanks for that information !!

RE: Generate Certificate for ClickOnce

Greg McGuffey — Tue, 13 Jan 2009 11:12:16 GMT

Yes, you only see the untrusted message on first install. After that, when the user starts the app, a "launching application" dialog will appear that indicates that ClickOnce is verifying the app. The app will then either startup or if a new build is available and required, it will automatically start downloading, install itself and the app will start. I can't remember what happens with an optional upgrade...just don't do optional installations (maybe once in two years).

RE: Generate Certificate for ClickOnce

Philipp Guntermann — Tue, 13 Jan 2009 10:42:14 GMT

Hi Greg,

thanks. i will try that tool tommorow.

Can u confirm that the "Untrusted Source" Message only appears on the first install, and not anymore on updates ? Because we plan to distribute the ClickOnce-Setup.exe file through novell NAP, so that a user clicks that and it will allways be up-to-date.

If it were showing the message for the updates aswell, instead we would need to distribute 2 shortcuts (one for update, and one for regular program use).

RE: Generate Certificate for ClickOnce

Greg McGuffey — Tue, 13 Jan 2009 10:31:13 GMT

Philip,

What I did for ClickOnce is to just generate the certificate using Visual Studio, then I used the tool from this site to extend the time of the certificate:

[url]http://www.may.be/renewcert/[/url]

I made it last like 10 years...probably by then we'll be using something else anyway. I did this about a year ago, so I don't remember exactly how it works, but I got it to work eventually. If you are already installing your app via ClickOnce in production, be sure to update the current certificate, or everybody has to uninstall/reinstall.

Good luck!

Greg

RE: Generate Certificate for ClickOnce

Philipp Guntermann — Tue, 13 Jan 2009 10:12:15 GMT

[quote][b]you are starting with a .SPC file that you received from the certificate company as well as the PVK.[/b][/quote]

Hi Trend, thanks for the reply.

However, we dont have a spc from a certificate company. basicly i want to make my own certificate. i dont care about the warning message during install. but i want it to last very long, or better never expire during the applications lifetime.

RE: Generate Certificate for ClickOnce

Trent L. Taylor — Tue, 13 Jan 2009 09:36:59 GMT

Yeah, this can be a frustrating process. It is never straight forward. The ultimate goal is to get the certificate in a pfx format then you can use the code signing tool to sign any EXE or install. This is the approach that we take. Generally you are starting with a .SPC file that you received from the certificate company as well as the PVK. To produce a PFX, you can use this pvkimprt tool:

[codesnippet]pvkimprt.exe -PFX mycert.spc mykey.pvk[/codesnippet]

RE: Generate Certificate for ClickOnce

Philipp Guntermann — Tue, 13 Jan 2009 08:30:45 GMT

this is what i got from reading the msdn information on the subject:

1) I start the "Visual Studio 2008 Command Prompt" and first enter:

C:\Programme\Microsoft Visual Studio 9.0\VC#>makecert.exe -n "CN=ERV" -pe -r -ek
u 1.3.6.1.5.5.7.3.3 -e 01/01/2039 -sv ERV.pvk ERV.cer -a sha1

This will ask me for a password twice. I choose "mypassword" for both.

It will then say: "Succeded".

2) Next i'll enter:

C:\Programme\Microsoft Visual Studio 9.0\VC#>pvk2pfx.exe -pvk ERV.pvk -spc ERV.c
er -pfx ERV.pfx

This will ask me for the password again. i enter "mypassword" again.

It will then create a file called ERV.pfx

3) Within the Solution in Visual Studio i goto properties->signing-> and select "From File". I then choose the created "ERV.pfx" file.

It will ask me for the password. I enter "mypassword".

Not i get an Errormessage saying "The password is invalid" !!

I also tried the same procedure selected "No Password" at step 1 and then never entering a password. It will still ask for a password when selecting the file in VS and then say "The password is invalid".