.NET Code Signing - Can I use an AD Certificate?

Question

I am working on an internal project which uses a bunch of OLEDB Providers - some of them have a UI. The biggest challenge is that I need to request uiAccess=true in the manifest which only is possible on Windows if the code is digitally signed. This application is only used internally. I am assuming AD's Primary Domain Controller already acts as CA for all the machines in the domain and is fully trusted. And it possible to generate code signing certificate for some purposes like SQL server and Infopath.

Can I use a code signing certificate Issued by my AD/PDC to sign my WPF application (not click-Once) and achieve this goal?

Answer 1

Yes you can. You need to set up an Enterprise Root Certification Authority.

Once you have your own CA, you can issue certificates for any purpose, including code-signing certificates. You can even set up your own timestamping server.

Note that these certificates will only be accepted by clients that trust your CA, but if your applications are only used internally, that will not be a problem.

This document might get you started:

• Building an Enterprise Root Certification Authority in Small and Medium Businesses