Re: Online Only Digital Signature

Hi James

What's important is not whether the file contains the private key, but
whether the certificate in the cert store has a private key associated with
it. I create certs by placing them into stores, rather than into files:

makecert -n "CN=clickonceweb" -pe -sr localmachine -ss my

In the above, the certificate is placed into the local machine store, and
has a private key associated with it. You can always export the certificate
without the private key into a .cer file.

Can you open the cert store, view the certificate. On the first tab of the
dialog, if there is a a key at the bottom of the dialog with the words 'You
have a private key that corresponds to this certificate' then you're OK as
regards having a private key. The signing page in Visual Studio points to the
certificate store, rather than to a certificate file (it points to the user
store), as you rightly said.

If the cert has a private key, then we've eliminated one source of error.

Hope this helps

Chris Seary

"James Pemberton" wrote:

I'm sorry I wasn't clear. I created my certificate file like so:

makecert -r -pe -a sha1 -n "CN=CompanyTest" -b 01/01/2000 -e 01/01/2036 -eku
1.3.6.1.5.5.7.3.3 -ss Name Name.cer

"Dominick Baier [DevelopMentor]" <dbaier@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
wrote in message news:4580be631987a78c81a74170e4a67@xxxxxxxxxxxxxxxxxxxxx
After I created my certificate file


what kind of file was that?



---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

After I created my certificate file, I used the signed certifacte I
had installed in one of my stores as the signature certificate.

"Dominick Baier [DevelopMentor]"
<dbaier@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:4580be631987a18c81a6da90e962a@xxxxxxxxxxxxxxxxxxxxx

you also have to sign the manifest - you need a private key for that,
usually packaged in a .pfx file.

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com
I am trying to deploy an application to our application server using
Clickonce. I was hoping not to have to install the application on
every Citrix server that our users access, but utilize the Online
Only function to actually run the application from the application
server. I have created a signature using MAKECERT called name.cer
and converted that to a name.spc. I then took the name.spc and added
the certificate to the "trusted Root Certification Authorities" and
the "Trusted Publishers" on one of my Citrix servers. But whenever
I try to execute the application I still get the dialog box about
the application being an unknown publisher. I am trying to
eliminate this from the user. Is there something else I can do to
publish the application to a server and then execute it from there
for any user that has access to the application directory?

Thanks






.

Relevant Pages

  • Re: PFXExportCertStoreEx
    ... which contains the actual PFX and write that to the disk. ... methods to export certificate + private key from the IE store. ...
    (microsoft.public.platformsdk.security)
  • Re: Unable to unwrap a symmetric key using the private key of an X
    ... the certificate (public and private key) is ... installed in the personal store of both local computer and current user and I ... The problem is related to the certificate store on the web service side. ... You installed the certificate in "OtherPeople" store but the policy points ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Client Certificates Issue
    ... "Active Directory User Objects" where the certificate is available, ... the Store Name for that store or, how can I access it using C#.Net code? ... not on your server. ... of the private key for the certificate they provided to the server. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: SmartCard CSP and CA certificate enrollment
    ... The Microsoft CA will not put your certificate anywhere. ... Now if you use the standard method with the smart card CSP than the CSP ... The CSP can put the cert into the local store the same time when it ... on the card into the cert store on the computer. ...
    (microsoft.public.platformsdk.security)
  • Re: Help please - Can not use/export private key after domain change
    ... You see only one EFS certificate in your private cert store? ... the certificate, also when I view it, it says that I have private key ... Windows XP encrypts the ...
    (microsoft.public.security)