UAC Patching and Digital Signatures

Question

We have an application that performs auto-updates. Until recently, we haven't run into any issues. However, a lot of our customers are finally upgrading to Windows 7 and running into all sorts of issues.

I've been tasked with updating the installer so it works on 7 (and Vista, although it appears none of our customers use Vista).

Based on this article, it appears that a standard user can apply a msp patch, provided it's signed with the same signature as the original install.

Does anyone have experience with this? Does the signature have to be 3rd party verified? I ask, because I followed this process and created my signatures for development, and when I installed on a separate Windows 7 box, it showed an Unknown Publisher and required the Admin to log in. I assumed it was because it was self-signed. However, I want to verify before we spend the money to get a 3rd party cert from Thawte or Verisign.

Answer 1

I think I've solved my own problem.

I took the certificates I created on my test box, and manually imported them into my W7 test box.

Once I did this, the patch was able to run without requiring admin password.

Obviously, I can only manually do my importing on test boxes, so I will need to get a 3rd party cert from Thawte or Verisign.