Clickonce application with code signing cert blocked by group policy if published from any system except mine

2
votes

Environment:

  • ClickOnce Winforms Application with a signing certificate (Symantec Class 3 SHA256 Code Signing CA)
  • Client computers are running windows 7 and users are under a group policy that disallows local admin access
  • There is a "Certificate Policy" applied to that group for our code certificate, which should allow any application with that cert to run with local admin privs
  • The group policy cannot be changed for security reasons
  • Up to 6 developers work on and publish this project
  • Visual Studio 2013

Symptoms:

When I publish the app from my system, it is able to auto-update and runs as expected.

When any other developer publishes, it auto-updates and the application fails to start. The dump contains the following error:

This program is blocked by group policy. For more information, contact your system administrator

If I re-publish from my machine, it will update and run as expected.

Signing:

The following steps are how we are applying the cert to the application:

  • Project Properties
  • Signing Tab
  • Select From File Button
  • Select the cert that is included in the project
  • Enter the cert password

Questions:

Why are we only able to update the ClickOnce application from one developer's computer and not the others, when the certificate is applied the same way?

Aside from disabling group policy, how can we successfully publish this application from multiple computers without encountering the same problem?

2
c#clickoncecode-signinggroup-policy

2 Answers

2
votes

I don't know the exact reason for why it is not working but I would say if the clickonce can be deployed on a third party machine and on this same machine it is working with the clickonce generated from your machine and not working with the clickonce generated from another developer machine you have done the hardest part.

You need to track down the differences between your two developer machines. Good candidates are registry or certificate store.

So for me you have those options:

  • Test with other machines (generation and deploy) to see if it is working
  • Check if .csproj settings for clickonce are exactly the same
  • Try to install the certificate in your local store and then use "Select from Store"
  • Check if the certificate chain is correct (root certificate installed, certificate installed in correct group, ..)
  • compare the registries on both dev machines (might be hard though if they are quite different)
  • compare the generated clickonce files with a file comparer especially the .manifest file (I already have tracked down errors this way)
2
votes

To piggyback on Fabian's answer, Microsoft recently made SHA256 certs backwards compatible, so they will work on older versions of windows. Since you are publishing to a Windows 7 machine, you can check the application file that gets generated on the server post publish refences: - Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"

If it says sha256, it may not be recognized by Windows 7 when you install.

If this is the case, try updating your version of Visual Studio - this should be included in the latest update.