Automatically Install: Self-Signing ClickOnce Manifests with Cert > Need App to Install Root CA in Trusted Root Certs on Client PC

ClickOnce is suppose to use a signing cert for distribution. If I was developing a major app, I could understand purchasing a cert. However, my app is for a small sized company and I cannot justify the expensive.

My question is, when my app first installs, how might I install my self signed Root CA into Trusted Root Certificates automatically so there are no issues with my self signed program?

My current self signed CA Root and program cert were setup between Exchange 2010/IIS 7.0 and OpenSSL. The clients will be remote so I do not want to use Microsoft's Certificate Authority. You can see how I developed the certs at http://www.tekcrack.com/creating-your-own-self-signed-sans-certificate-for-exchange-2010-and-iis-70-1of3.html

Has anyone encountered the same problem? What route did you take to work around it...for free?

I don't know if that certificate will work for ClickOnce deployment. What you need is a code-signing certificate. I think you can buy one from GoDaddy for less than a hundred bucks, which is pretty inexpensive for giving your customers that nice warm feeling of having a trusted publisher.

If your customer has a domain administrator and any kind of central IT group, they can create a certificate for you that will be trusted.

You can't install a certificate programmatically on the user's computer. A ClickOnce application will not have that level of privilege. You have to have the customers install the certificate. Plus, it would be a huge security gap if people could install certificates without the user's knowledge.

And my last words of wisdom -- be sure your certificate is password-protected, and nobody can get their hands on it. If they do, and the certificate is installed in the store on the users's computer, they will be able to install applications on the user's computer in your name.

Having said all of that, I think this article will be helpful to you:

http://msdn.microsoft.com/en-us/library/ms996418.aspx#clickoncetrustpub_topic1

Just another reason why I believe I will steer clear of ClickOnce...Thanx for the info. I think I will stick with my role-your-own update/installer at this point.

ThaKidd 2010-07-03 18:02:32

Sure, I understand. The best solution for ClickOnce is to have a valid certificate from a third party, or to have the network guys create one (generally in a corporate environment). You do, of course, lose the most valuable feature of ClickOnce, which is the incremental updates, and being able to ensure the user is running a specific version. Anyway, good luck!

RobinDotNet 2010-07-04 03:08:41

The other thing is you can just sign it with a self-created certificate, and let the users know that's why it says "unknown publisher". Since they know you personally (I assume), and aren't just clicking on some random link on a webpage, it will probably be okay with them. The certificate, signing the manifest, and the automatic hashing of the files are all used by ClickOnce to make sure the files are not tampered with, and the deployment isn't hijacked. So just having it signed adds a level of security, even if it isn't from a Certificate Authority.

RobinDotNet 2010-07-04 03:10:57

Just FYI, it only shows that prompt the first time they install the application. When receiving updates, it doesn't prompt; it assumes it's okay since it's already installed. Now you know more about C/O deployment than you probably ever wanted to know. :-)

RobinDotNet 2010-07-04 03:11:47

ansaurus

tags:

views:

answers:

Automatically Install: Self-Signing ClickOnce Manifests with Cert > Need App to Install Root CA in Trusted Root Certs on Client PC

related questions