Self Sign Certificate To Authenticode Certificate?

Question

We deployed a windows application via ClickOnce and a self signer certificate that we created. We are now looking in to getting a Authenticode Certificate from a Certificate Authority like VeriSign.

When we start signing our ClickOnce manifests with the new certificate, will our users have to re-install the application?

Are there any known migration paths for dealing with our scenario?

Thanks

Answer 1

Yes, you can do this without the users having to re-install, but it's tricky. The key is to realise that the application manifests have an Authenticode signature (to identify the publisher) and a strong name signature (to prevent tampering). The trick is to use your old certificate for the strong name signature, and the new certificate for the Authenticode signature.

Neither VS2005/Mage or the sign tool (signtool.exe) from the .NET Framework SDK supports this kind of signing. But the Windows Server 2003 R2 Platform SDK contains a newer version of signtool.exe with a new switch "/manifest" and with options to use different keys for signing. With this tool you can sign the ClickOnce manifests with different keys for each of the two signatures.

You can find more details here.