Signed Installer Cert Not Recognised

[H4nd0]

Hello,

IA Studio v10 Mooya.rtm.51110.

We use a Versign authenticode cert to sign the installer. When run under Win7 the installer asks to elevate but the cert injected into installer is not recognised (and hence the Verified Publisher notification is not displayed).

I've checked the installer and the cert is definitely in there and valid. The same cert is used to sign the subsequently installed EXEs and DLLs.

I'm stumped as to why the cert is not recognised in the EXE?!

I've checked:

1. Validity of the .spc and .pvk file
2. The IA10 setup configuration
3. The output EXE installer properties
4. That there is a consistent failure on multiple Vista and 7 boxes and VMs

One thing I have noticed is that sometimes when I attempt to obtain the EXE properties via Explorer ... Explorer can hang up and return 10-20 seconds later with the cert info.

Any pointers gratefully appreciated.

Cheers,

j.

[giaviv]

Dear j,

Please take a look at this thread:
http://www.installaware.com/forum/viewt ... f=2&t=6249
Are you having the same problem? Did you try running this on different OS's (XP / 2003 for example)?

[H4nd0]

Hi there,

Thanks for pointing out that post. I left a note for Daniel.

As per his comments - the method used to sign the installer is deprecated. Microsoft replaced signcode with signtool in 2003. How can we replace the underlaying version of the signing tools?

http://msdn.microsoft.com/en-us/library ... 80%29.aspx

I create MSI's post creation of the EXE installer and sign them with signtool 5.2.3790.1830 and they are recognised fine by Windows 7. Further, all our EXEs are signed with the same version and don't exhibit that problem.

FYI: I ran into issues with Comodo certs a few years back ... they were using a series of extensions that signcode just did not recognise - don't remember the specifics now except the gear I was installing the cert into was the limiting factor. But it meant that the certificate chain was incomplete. They had to re-issue me a legacy root certificate to make it work. I'm wondering if the problem is similar?

So does IA10 actually use signcode.exe or does it use miaCert.exe? Does miaCert.exe use signtool.exe?

Thanks!

James

[giaviv]

Dear James,

We are currently looking into the code signing feature of InstallAware - I will keep you updated.