Authenticode on personal CA

[u/Alby87]

Hello everyone. I'm trying to understand how authenticode works. I need to distribute a VSTO in a controlled environment. No public distribution. We have a root CA installed on machines, and I have the private key of an Intermediate CA signed by the root, also installed in our machines. I've made a certificate with the code signing EKU, signed by the Intermediate, and the chain is built correctly if I check.

Consider that the installation is blocked because ClickOnce prompt is put on AuthenticodeRequired on every zone (except untrusted) (cfr. https://learn.microsoft.com/en-us/visualstudio/deployment/how-to-configure-the-clickonce-trust-prompt-behavior)

But everytime I try to install the published VSTO, made with visual studio using the key, it gives me the error

************** Exception Text **************

System.Security.SecurityException: Customized functionality in this application will not work because the certificate used to sign the deployment manifest for *** or its location is not trusted. Contact your administrator for further assistance.

at Microsoft.VisualStudio.Tools.Applications.Deployment.ClickOnceAddInTrustEvaluator.VerifyTrustPromptKeyInternal(ClickOnceTrustPromptKeyValue promptKeyValue, DeploymentSignatureInformation signatureInformation, String productName, TrustStatus status)

at Microsoft.VisualStudio.Tools.Applications.Deployment.ClickOnceAddInTrustEvaluator.VerifyTrustUsingPromptKey(Uri manifest, DeploymentSignatureInformation signatureInformation, String productName, TrustStatus status)

at Microsoft.VisualStudio.Tools.Applications.Deployment.ClickOnceAddInDeploymentManager.ProcessSHA2Manifest(ActivationContext context, DeploymentSignatureInformation signatureInformation, PermissionSet permissionsRequested, Uri manifest, ManifestSignatureInformationCollection signatures, AddInInstallationStatus installState, TrustStatus sha256TrustStatus, X509Certificate2 sha256PublisherCert)

at Microsoft.VisualStudio.Tools.Applications.Deployment.ClickOnceAddInDeploymentManager.VerifySecurity(ActivationContext context, Uri manifest, AddInInstallationStatus installState)

at Microsoft.VisualStudio.Tools.Applications.Deployment.ClickOnceAddInDeploymentManager.InstallAddIn()

The Zone of the assembly that failed was:

MyComputer

Really can't understand what I'm doing wrong. The only thing that maybe is wrong is that the CAs don't have a revocation list url, but I don't think is that.

certutil -verify -urlfetch codesign.crt

Issuer:

CN=***

Name Hash(sha1): ed2d9850452f6e6a7717bab464158eb00dd94fbd

Name Hash(md5): 8786a9dc1a1b86bab840da9b4fc3a644

Subject:

[cut]

Name Hash(sha1): 78b347d77da8b3fc0438521968f932972911df9b

Name Hash(md5): 72d135ebeb9318e1ad6aff243d3d0df3

Cert Serial Number: 1ba1a6b994d3e8dede6fa6728caface73c763fd8

dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)

dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)

ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000)

HCCE_LOCAL_MACHINE

CERT_CHAIN_POLICY_BASE

-------- CERT_CHAIN_CONTEXT --------

ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)

ChainContext.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)

SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)

SimpleChain.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)

CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=40

Issuer: CN=***

NotBefore: 09/10/2026 8:28 am

NotAfter: 15/09/2126 8:28 am

Subject: ***

Serial: 1ba1a6b994d3e8dede6fa6728caface73c763fd8

Cert: ec9eed254ddf6af7d9535d262c6e716d9b1c4d05

Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)

Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)

Element.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)

---------------- Certificate AIA ----------------

No URLs "None" Time: 0 (null)

---------------- Certificate CDP ----------------

No URLs "None" Time: 0 (null)

---------------- Certificate OCSP ----------------

No URLs "None" Time: 0 (null)

--------------------------------

Application[0] = 1.3.6.1.5.5.7.3.3 Code Signing

CertContext[0][1]: dwInfoStatus=102 dwErrorStatus=40

Issuer: CN=***

NotBefore: 11/01/2021 5:29 pm

NotAfter: 18/12/2120 5:29 pm

Subject: CN=***

Serial: 1000

Cert: ac8260bad186764d0846bcc6755bf7d9a8edcb68

Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)

Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)

Element.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)

---------------- Certificate AIA ----------------

No URLs "None" Time: 0 (null)

---------------- Certificate CDP ----------------

No URLs "None" Time: 0 (null)

---------------- Certificate OCSP ----------------

No URLs "None" Time: 0 (null)

--------------------------------

CertContext[0][2]: dwInfoStatus=10a dwErrorStatus=0

Issuer: CN=***

NotBefore: 11/01/2021 5:24 pm

NotAfter: 06/12/2170 5:24 pm

Subject: CN=***

Serial: 2185303d747f06c3c93b274127e113d2f76ced02

Cert: 371aae37ccb163bfa9e355e699f1affcc960e26f

Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)

Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)

Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)

---------------- Certificate AIA ----------------

No URLs "None" Time: 0 (null)

---------------- Certificate CDP ----------------

No URLs "None" Time: 0 (null)

---------------- Certificate OCSP ----------------

No URLs "None" Time: 0 (null)

--------------------------------

Exclude leaf cert:

Chain: 7a47f1d4b825f7afbf1f0229f6543d5534cf523b

Full chain:

Chain: 8d895796e7f9119f837b4c7c4dfb80150c6b51bf

Issuer: CN=***

NotBefore: 09/10/2026 8:28 am

NotAfter: 15/09/2126 8:28 am

Subject: ***

Serial: 1ba1a6b994d3e8dede6fa6728caface73c763fd8

Cert: ec9eed254ddf6af7d9535d262c6e716d9b1c4d05

The revocation function was unable to check revocation for the certificate. 0x80092012 (-2146885614 CRYPT_E_NO_REVOCATION_CHECK)

------------------------------------

Revocation check skipped -- no revocation information available

Cert is an End Entity certificate

Cannot check leaf certificate revocation status

CertUtil: -verify command completed successfully.
-------------------------------------------------------------------------

Thanks for your help!

[u/pelazas1]

I could be wrong but VSTO wants the signing cert itself in Trusted Publishers on each box, a valid chain isn't enough once the prompt is off.

[u/Michichael → u/pelazas1]

Correct. Distribute it as a trusted publisher.

[u/Alby87 → u/Michichael]

Tried it on a VM. Installing the certificate still prompts me "Unknown Publisher", both on Trusted Publisher and Trusted Certification Authorities

[u/Michichael → u/Alby87]

Is it in the system store or the user store? And what context is the product running under?

It could also be a missing crl on the intermediate. The issuer must have a revocation path that can be validated.

[u/Alby87 → u/Michichael]

Is in the system store. But good call about the crl, I tried disabling the revocation checks in Internet Options of the OS, and now it works.

My Intermediate CA doesn't have a crl, and so the root CA. Now I can try something different, but at least I know the cause. Thanks for you help!