Deploying a VSTO add-in on Windows 8 without a signed certificate

Question

I've written a Word VSTO add-in that I would like to give to some colleagues and friends. I originally wanted to use ClickOnce for deployment because it's easy to set up for me and also very easy to install. The deployment of my add-in works fine on Windows 7, but I have some trouble with Windows 8/8.1. The SmartScreen filter complains about my add-in and completely prevents the installation. Here I've found out that the problem is that I haven't signed the add-in with a real certificate. The only solution seems to be to make the user "install the test certificate in the Trusted Publishers store" (which they strongly advise against) or to get a certificate from an authority, which is not an option for me as I'm only a hobby developer and don't want to pay hundreds of dollars/euros a year for a certificate.

So, is there any other way of deploying the add-in without a certificate? Could I use another installer that doesn't require a certificate? Or will the SmartScreen filter always block all attempts to install a VSTO add-in that is not signed with a "real" certificate, regardless of the installer?

I'm really a bit annoyed about Microsoft in this respect - Why are they making it so difficult for small and independent developers to deploy their application to their users?

Any help would be really appreciated!

sr258

Answer 1

The certificate is required for security reasons. Instead of purchasing a certificate from a trusted vendor you can adjust the security settings on the PC (at least turn off the Smart Filter) and use a test certificate. See Granting Trust to Office Solutions.

The Deploying an Office Solution section in MSDN describes all the required steps for depolying Office add-ins. You also may consider using an MSI installer instead (InstallShield, WiX and etc.).

Answer 2

You can go for Visual Studio Setup Projects or Wix Based Setup to deploy your VSTO add-ins.

I have distributed Signed as well as Unsigned VSTO based add-ins. I always prefer to go with regular setups. The only problem which I face with unsigned/Test-signed VSTO add-ins is that the Trust Center setting of Client's Office restricts or warn user on the first run of Office Application.

Answer 3

The best solution is distributing a zip containing the .vsto and telling the user to click on it instead of clicking on setup.exe.