.NET Ramblings - Brian Noyes' Blog - ClickOnce Publisher Certificate Renewals and Updating Your Application

Tuesday, November 21, 2006

ClickOnce Publisher Certificate Renewals and Updating Your Application

A fairly messy little detail of ClickOnce has surfaced that I wanted to get some word out about regarding publisher certificate renewals and how they affect ClickOnce.

ClickOnce only allows you to perform an update to an application if the updated version manifests are signed by the same publisher certificate as was used to originally sign the application.

When ClickOnce was designed, the product team understanding was that certificate issuers such as Verisign and thawte would renew certificates without re-issuing a new certificate (with a new private/public key pair). Unfortunately, that understanding was incorrect. Certificate issuers do in fact issue a whole new cert, just one that has the same CN (Common Name) when they do a renewal.

The result of this is that if you have a ClickOnce application in production and your publisher cert expires, you will no longer be able to issue updates to your application with your new cert. You will have to have users uninstall the previous version and install the new version as a fresh install.

To combat this for the near term, you may want to consider buying a cert that lasts longer than a year.

Microsoft is looking into a fix for this in the Orcas release, but the details of what that fix will look like and how it will affect the update process is yet to be determined.

.NET | ClickOnce

Tuesday, November 21, 2006 9:35:16 PM (GMT Standard Time, UTC+00:00)

Comments [3] |

Monday, November 27, 2006 7:47:57 PM (GMT Standard Time, UTC+00:00)

Brian,

First I would like to say I really appreciate all the great information you have been providing on Databinding and ClickOnce. I bought your DataBinding book and plan on purchasing your ClickOnce book as soon as it comes out. Also the document you wrote for SCSF was great it really helped me out!

I ran across this issue a couple weeks ago. I was in the middle of trying to track down a problem and needed to deploy my application. As you described I couldn't publish my application, because the certificate had expired. After spending some time searching on the web/newsgroups I came across someone else who had the problem. Someone from Microsoft and I believe they were on the ClickOnce team responded. If you call Microsoft Support they have a utility that will renew your certificate without having to uninstall and reinstall the application. I used it and it worked for me. It pushed the expiration date out to 2011. The name of the utilty is renewcert.

Thanks again,

John

John Key

Friday, December 01, 2006 6:04:25 AM (GMT Standard Time, UTC+00:00)

Devil of outside, the content of the angel, return hesitant what?
<a href="http://www.club-wowgold.com">game</a>

huajuan

Monday, December 11, 2006 2:26:44 AM (GMT Standard Time, UTC+00:00)

Devil of outside, the content of the angel, return hesitant what?<a href="http://www.power4game.com">game</a>

huajuan

Comments are closed.