ClickOnce certificate expired - not signing manifest

Question

I have a distributed application using ClickOnce. I went to do an update and got an error about the certificate expiring. I noticed on the signing tab that I could uncheck signing the ClickOnce manifests. I did this and successfully published my application. It worked fine for the first seven users - but just had a user that is getting the dreaded:

Manifest XML signature is not valid.

+ No signature was present in the subject.

I will have dozens more users trying over the next 24 hours. I am crossing my fingers that I don't have a major problem. I've done a bunch of reading about the problems/bugs with MS ClickOnce and expiring certificates, and I am hoping to avoid them by simply not signing. The certificate that expired was just a generic one that seemed to be created when setting up ClickOnce originally. Is there a problem going from a signed manifest to unsigned manifest?

The user that is having trouble could not even uninstall and reinstall the application. We have tried everything that I can think of - including deleting his User\Local Settings\Apps\2.0 folder.

Also, what can I do for this user that suddenly can't use our application?

Answer 1

The expiring certificate problem was fixed in one of the service packs to .NET 2. Installing the latest framework (3.5 SP1) will definitely include the fix. You can just switch to a renewed certificate and redeploy.

If really want to go unsigned, I think the fix is same - make sure your users have .NET 3.5 SP1 and make it a prerequisite in your ClickOnce settings.

Answer 2

makecert -sv MakarioUK.pvk -n "cn=MakarioUK" MakarioUK.cer -b 01/01/2011 -e 01/01/2050 -r