Unknown publisher on Windows 7

[danielb]

When starting our installation on Windows 7 the UAC prompt says "Unknown publisher". On other operating systems (such as Windows Server 2008) the correct publisher name is shown by the UAC prompt. If I select to show the properties on the setup file the correct publisher (our company name) is shown under the tab Digital Signature (on all operating systems).

I can fix this by doing one of following :
1. Select to show properties on the setup file. Select the Digital Signature tab. Click the Information button. Click Ok.
2. Resign the setup file manually:

Code: Select all

signtool.exe sign /d "Description" /du "http://www.someurl.com" /f "VeriSignKey.pfx" /p pasword /t "http://timestamp.verisign.com/scripts/timestamp.dll" "Setup.exe"

I can guess at least two reasons to the behaviour:
1. Our conversion from our PFX-file (from Verisign) to SPC- and PVK-files is not correctly done.
2. A bug in InstallAware 10

The conversion from PFX to SPC- and PVK-files is done by following steps:

Code: Select all

openssl pkcs12 -in "VeriSignKey.pfx" -nokeys -out "TempPublicKey.pem"
openssl crl2pkcs7 -nocrl -certfile "TempPublicKey.pem" -outform DER -out "mycredentials.spc"

openssl pkcs12 -in "VeriSignKey.pfx" -nocerts -nodes -out "TempPrivateKey.pem"
openssl rsa -in "TempPrivateKey.pem" -outform PVK -pvk-strong -out "myprivatekey.pvk"

Anyone who havs a clue? Thanks in advise.

[giaviv]

Dear Daniel,

InstallAware simply calls Microsoft's signing tools - thus do not think that this is a bug in IA.
Please try contacting your code signing vendor help on this issue since most likely this is where the problem stems.

Thanks

[danielb]

Dear Aviv,
Thanks for your quick reply. Maybe the reason is that you use very old sign tools from Microsoft? Signcode.exe (version 5.131.1863.1) which is shipped with InstallAware 10 was replaced by the new tool Signtool.exe from Microsoft seven years ago. Signcode is not supported of Microsoft any longer (see https://winqual.microsoft.com/Help/code ... ign_id.htm).

[alibaba]

Maybe the root certificate is not available for your cert. Check the certification path in the certificate.

[danielb]

Maybe the root certificate is not available for your cert. Check the certification path in the certificate.

The certificate is ok. The correct publisher is shown on every OS except Windows 7.

[H4nd0]

Hi Daniel,

I'm having the identical problem. I manually sign with a recent version of SignTool and all is OK - however, if I sign during the IA install build process the cert is not recognised. I've only started to encounter this problem since moving to IA10 and getting my Authenticode cert updated last year.

This is how I'm creating our PVK/SPC - slightly different to yours.

REM These are the commands to convert a PFX to PVK/SPC
REM You will need OpenSSL
REM http://www.tech-pro.net/export-to-pvk-spc.html
REM http://www.drh-consultancy.demon.co.uk/pvk.html

openssl.exe pkcs12 -in mycert.pfx -nocerts -nodes -out mykey.pem
pvk.exe -in mykey.pem -topvk -strong -out mykey.pvk
openssl.exe pkcs12 -in mycert.pfx -nokeys -out mycert.pem
openssl.exe crl2pkcs7 -nocrl -certfile mycert.pem -outform DER -out mycert.spc

Cheers,

James

[danielb]

Hi James,
I also solved my problems by doing a manual sign of the setup file with Signtool. The signing of the "inner setup file" done by InstallAware seems to be good enough so far.
But it is still strange that InstallAware ship tools from Microsoft which has been deprecated for seven years...

[H4nd0]

Hi Daniel,

I'm not even sure those EXEs are used - but irrespective they are obsolete. miacert.exe appears to be the signing app? I've had a similar problem in the past with Comodo and it was due to the certificate chain (root and/or intermediates) as a result of extensions being present that the signing tool just does not recognise. IA uses the spc/pvk whilst signtool uses the pvk. So I suspect the following:

1. Our method of creation of the spc/pvk is incorrect for the 2010/2011 Verisign cert? Or the cert has extensions which miacert.exe doesn't recognise?
2. miacert.exe (or signcode.exe) isn't signing correctly and injecting the full certificate chain into the EXE (this is by virtue of a sizing differential of 1KB between a signtool version of the exe and miacert version)?
3. There's something in 7 which is fastidious about the certificate chain - 2008 etc. are more relaxed?

I'm no expert on code signing but Irrespective the workaround is sign inside IA then re-sign with signtool, yes?

Here's the other thread: http://forums.installaware.com/viewtopic.php?f=2&t=6313

Cheers,

j.

[kpendergast]

James-

Thanks for posting your method using the PVKTool. That fixed the same problem I was having.

The steps above using OpenSSL to create the PVK do not seem to work, but the steps using PVKTool do. BTW, I do not believe that you need to use signtool if the internal signing is successful.

Ken