Test digital signature isn't recognized in Vista?

[BNewell]

Hello,

I've generated a test certification using the steps at http://msdn.microsoft.com/en-us/library/bb172338(VS.85).aspx, and am now trying to get Vista to stop displaying the "An unidentified program wants access to your computer" message.

I have tried both manually signing all of the cabs, MSI, and EXEs, as well as using the Release Wizard to input the signature. Either process seems to generate the expected result: files with what appears to be a correct digital signature when I look at their properties under Vista. Verifying the files with signtool from the Platform SDK also works as expected.

The fun begins when I try to test them on a Vista test machine. I have imported the test certificate to the Trusted Root Certification Authorities using certmgr.msc, and the signatures show up in the file properties of all of the installer files. However, whenever I run setup.exe, I get the previously mentioned error. It seems that Vista isn't recognizing the digital signature. Has anybody encountered this before, or have any suggestions as to how to track down the problem?

-Ben

[Roman1]

Hello,
I use spc and pvk original Verisign files for signing my setup.

The publisher is not being shown in Vista UAC Window.
"Unknown publisher"
But the certificate is marked as ok.

If I sign setup.exe outside of dev using SignCode.exe Wizard,
Vista displays correct the publisher.

It must be a bug within isDev. Perhaps are some parameters
by call of SignCode not correct.

[MichaelU]

Test certificates yield packages which can be verified as signed, but are not trusted because the certificate chain isn't trusted. A package which is not trusted due to any of no signature, invalid signature, or untrusted certificate, will receive the "Unknown publisher" message.

I don't know what is wrong with the scenario Roman1 is describing; I haven't seen this, and am certain I've seen similar scenarios work both with IS12 and IS2008. It might be useful to compare the extended digital signature properties in explorer between the two signing methods looking for a difference.

[BNewell]

First, thank you for the response!

You say that a test certificate will show up as "Unknown Publisher". Is that true even if I add my certificate to the Trusted Root Certificate Authorities?

If so, that introduces a new conundrum for me, as I need the installer to be trusted (on a test machine only) for Games For Windows testing, before we certify it.

-Ben

[MichaelU]

I'm not 100% certain. I suspect installing the certificate itself in the trusted list will result in it being trusted despite being under the test root. If so, this certificate's signatures can then be valid on that machine.

[BNewell]

That's what I thought as well, but it doesn't seem to work. We're getting our key soon, so I'll revisit this when that arrives. Hopefully, this will just start working once I'm actually using a real CA, although I would have loved to have gotten a test implementation running first.

Thanks for the help.

-Ben