Issuing Code-signing Certificate with Private Key

Issuing Code-signing Certificate with Private Key

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Issuing Code-signing Certificate with Private Key jwgoerlich 12-27-2007
Posted by on December 27, 2007, 11:41 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hello group,

I am issuing a code-signing certificate from an Enterprise CA. I am
currently using the Certificate Services' web interface with the code-
signing template.

There does not seem to be an option to export the private key, though
I understand that is a requirement in Visual Studio 2005. When using
ClickOnce, Visual Studio reponds that "The selected file does not
contain a private key. You must choose a certificate that contains a
private key."

I have exported the key using the Certificates MMC. The Certificate
Authority is reporting that "the associated private key is marked as
not exportable."

What am I missing?

J Wolfgang Goerlich


Related Links:

ClickOnce Manifest Signing and Strong-Name Assembly Signing Using
Visual Studio Project Designer's Signing Page
http://msdn2.microsoft.com/en-us/library/aa730868(vs.80).aspx

Posted by Brian Komar on December 27, 2007, 12:58 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
You need to create a v2 certificate template based on the default Code
Signing certificate that allows key export. Of course, your enterprise CA
must be running on Enterprise Edition to allow the issuance of the v2
certificate template.
A certificate based on the custom template will allow export as you require
Brian

> Hello group,
>
> I am issuing a code-signing certificate from an Enterprise CA. I am
> currently using the Certificate Services' web interface with the code-
> signing template.
>
> There does not seem to be an option to export the private key, though
> I understand that is a requirement in Visual Studio 2005. When using
> ClickOnce, Visual Studio reponds that "The selected file does not
> contain a private key. You must choose a certificate that contains a
> private key."
>
> I have exported the key using the Certificates MMC. The Certificate
> Authority is reporting that "the associated private key is marked as
> not exportable."
>
> What am I missing?
>
> J Wolfgang Goerlich
>
>
> Related Links:
>
> ClickOnce Manifest Signing and Strong-Name Assembly Signing Using
> Visual Studio Project Designer's Signing Page
> http://msdn2.microsoft.com/en-us/library/aa730868(vs.80).aspx


Posted by =?Utf-8?B?Sm9obiBYaWU=?= on January 4, 2008, 11:26 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi Brian,

I would like to know what the default code sign template used for? If we
can't use it to sign code.

Thanks.



"Brian Komar" wrote:

> You need to create a v2 certificate template based on the default Code
> Signing certificate that allows key export. Of course, your enterprise CA
> must be running on Enterprise Edition to allow the issuance of the v2
> certificate template.
> A certificate based on the custom template will allow export as you require
> Brian
>
> > Hello group,
> >
> > I am issuing a code-signing certificate from an Enterprise CA. I am
> > currently using the Certificate Services' web interface with the code-
> > signing template.
> >
> > There does not seem to be an option to export the private key, though
> > I understand that is a requirement in Visual Studio 2005. When using
> > ClickOnce, Visual Studio reponds that "The selected file does not
> > contain a private key. You must choose a certificate that contains a
> > private key."
> >
> > I have exported the key using the Certificates MMC. The Certificate
> > Authority is reporting that "the associated private key is marked as
> > not exportable."
> >
> > What am I missing?
> >
> > J Wolfgang Goerlich
> >
> >
> > Related Links:
> >
> > ClickOnce Manifest Signing and Strong-Name Assembly Signing Using
> > Visual Studio Project Designer's Signing Page
> > http://msdn2.microsoft.com/en-us/library/aa730868(vs.80).aspx
>
>

Posted by Paul Adare on January 4, 2008, 12:28 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
On Fri, 4 Jan 2008 08:26:03 -0800, John Xie wrote:

> Hi Brian,
>
> I would like to know what the default code sign template used for? If we
> can't use it to sign code.

Brian never said that you couldn't use a certificate based on the default
V1 template to sign code. All he said was that you couldn't modify the
template to allow private key export like the OP wanted to do.

>
>
> "Brian Komar" wrote:
>
>> You need to create a v2 certificate template based on the default Code
>> Signing certificate that allows key export. Of course, your enterprise CA
>> must be running on Enterprise Edition to allow the issuance of the v2
>> certificate template.
>> A certificate based on the custom template will allow export as you require
>> Brian
>>
>>> Hello group,
>>>
>>> I am issuing a code-signing certificate from an Enterprise CA. I am
>>> currently using the Certificate Services' web interface with the code-
>>> signing template.
>>>
>>> There does not seem to be an option to export the private key, though
>>> I understand that is a requirement in Visual Studio 2005. When using
>>> ClickOnce, Visual Studio reponds that "The selected file does not
>>> contain a private key. You must choose a certificate that contains a
>>> private key."
>>>
>>> I have exported the key using the Certificates MMC. The Certificate
>>> Authority is reporting that "the associated private key is marked as
>>> not exportable."
>>>
>>> What am I missing?
>>>
>>> J Wolfgang Goerlich
>>>
>>>
>>> Related Links:
>>>
>>> ClickOnce Manifest Signing and Strong-Name Assembly Signing Using
>>> Visual Studio Project Designer's Signing Page
>>> http://msdn2.microsoft.com/en-us/library/aa730868(vs.80).aspx
>>
>>


--
Paul Adare
MVP - Virtual Machines
http://www.identit.ca
BPI: A 1960s term used to describe unmentionable parts of the anatomy, as
in
"you bet your bpi".

Posted by =?Utf-8?B?Sm9obiBYaWU=?= on January 4, 2008, 2:02 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Actually, I tried use the v1 template to sign my code. The result is that the
certificate doesn't appear in trusted software publisher store. it is in
personal folder store.

According the link (http://www.kinook.com/blog/?p=10), in order to sign a
code, we need to have the code signing certificate with private key
exportable, and it looks like that we are not able to do that with windows
server 2003 standard edtion.

Also, I would like to know what are this code signing will do? I can list
the following:
1. sign VBA code, so you don't need to change security setting to low to
let it work.
2. When you download the signned code, it will show you certificate in the
Security Warning window.
3. when you run the program, it will show your certificate in the security
warning window.

what else?

thanks.

John


"Paul Adare" wrote:

> On Fri, 4 Jan 2008 08:26:03 -0800, John Xie wrote:
>
> > Hi Brian,
> >
> > I would like to know what the default code sign template used for? If we
> > can't use it to sign code.
>
> Brian never said that you couldn't use a certificate based on the default
> V1 template to sign code. All he said was that you couldn't modify the
> template to allow private key export like the OP wanted to do.
>
> >
> >
> > "Brian Komar" wrote:
> >
> >> You need to create a v2 certificate template based on the default Code
> >> Signing certificate that allows key export. Of course, your enterprise CA
> >> must be running on Enterprise Edition to allow the issuance of the v2
> >> certificate template.
> >> A certificate based on the custom template will allow export as you require
> >> Brian
> >>
> >>> Hello group,
> >>>
> >>> I am issuing a code-signing certificate from an Enterprise CA. I am
> >>> currently using the Certificate Services' web interface with the code-
> >>> signing template.
> >>>
> >>> There does not seem to be an option to export the private key, though
> >>> I understand that is a requirement in Visual Studio 2005. When using
> >>> ClickOnce, Visual Studio reponds that "The selected file does not
> >>> contain a private key. You must choose a certificate that contains a
> >>> private key."
> >>>
> >>> I have exported the key using the Certificates MMC. The Certificate
> >>> Authority is reporting that "the associated private key is marked as
> >>> not exportable."
> >>>
> >>> What am I missing?
> >>>
> >>> J Wolfgang Goerlich
> >>>
> >>>
> >>> Related Links:
> >>>
> >>> ClickOnce Manifest Signing and Strong-Name Assembly Signing Using
> >>> Visual Studio Project Designer's Signing Page
> >>> http://msdn2.microsoft.com/en-us/library/aa730868(vs.80).aspx
> >>
> >>
>
>
> --
> Paul Adare
> MVP - Virtual Machines
> http://www.identit.ca
> BPI: A 1960s term used to describe unmentionable parts of the anatomy, as
> in
> "you bet your bpi".
>

Similar ThreadsPosted
Certificate Authority Stoped issuing certificates October 18, 2005, 12:31 pm
Computer Certificate Private Key December 7, 2007, 9:26 am
DLink DSA-3100 Digital Certificate and Private Key September 27, 2006, 2:46 am
Not Re-issuing certificates May 26, 2006, 4:16 am
Issuing CA - Common Name? June 23, 2008, 4:44 pm
Issuing Web Browser digital certificates October 27, 2005, 9:39 pm
Issuing certificates with critical KeyUsage October 10, 2006, 4:20 am
OpenSSL Root CA and Microsoft Issuing CA October 14, 2006, 2:12 pm
Where's my private key? February 16, 2007, 4:57 pm
No permssions on private key March 30, 2006, 11:15 am

The site map in XML format XML site map

Contact Us | Privacy Policy