2
votes

What exactly is the requirement to create a company internal App with Xamarin.Forms UWP? I can compile the *.appxbundle-Package but nobody can install it because of an certificate error. If I try to use our normal code signing certificate from StartSSL to sign the package, I got the following error:

The Manifest Designer could not import the certificate.

The certificate you selected is not valid for signing because it is either expired or has another issue. For more information, see: https://go.microsoft.com/fwlink/?LinkID=241478

The same certificate is used by our other desktop application with the signtool, so I guess the certificate is ok. Usage of the signtool for other .NET assemblies such as WPF projects:

"C:\Program Files (x86)\Windows Kits\10\bin\x86\signtool.exe" sign /f "..\..\..\..\..\Finaltec\Framework\Signing.pfx" /p ... /tr "http://timestamp.globalsign.com/scripts/timestamp.dll" "$(TargetPath)"

Are there any special requirements to sign a UWP app so anyone can install it? The used certificate is a Class 3 StartSSL Code Signing Certificate and it is valid until Junuary 2020. If I try to install the app with the generated test certificate from the Visual Studio, I got the message that the root certificate is not trusted and the installation process will be canceled. Even if I install the certificate manual before I got the same result error.

Code Signing Certificate informations:

  • Name: CVA Computer - Visualisierung und Animation GmbH
  • Address: Beckebohnen 2
  • Zip, City: 31618 Liebenau
  • State, Country: Niedersachsen, DE
  • Phone: +49-502398110
  • Email: [email protected]
  • Expiry Date: 2017-04-14

Package.appxmanifest content:

<?xml version="1.0" encoding="utf-8"?>
<Package xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10" xmlns:mp="http://schemas.microsoft.com/appx/2014/phone/manifest" xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10" IgnorableNamespaces="uap mp">
  <Identity Name="f736c883-f105-4d30-a719-4bf328872f5e" Publisher="CN=CVA Computer - Visualisierung und Animation GmbH" Version="1.0.1.0" />
  <mp:PhoneIdentity PhoneProductId="f736c883-f105-4d30-a719-4bf328872f5e" PhonePublisherId="00000000-0000-0000-0000-000000000000" />
  <Properties>
    <DisplayName>CVA.COS_App</DisplayName>
    <PublisherDisplayName>CVA Computer - Visualisierung und Animation GmbH</PublisherDisplayName>
    <Logo>Assets\StoreLogo.png</Logo>
  </Properties>
  <Dependencies>
    <TargetDeviceFamily Name="Windows.Universal" MinVersion="10.0.0.0" MaxVersionTested="10.0.0.0" />
  </Dependencies>
  <Resources>
    <Resource Language="x-generate" />
  </Resources>
  <Applications>
    <Application Id="App" Executable="$targetnametoken$.exe" EntryPoint="FPCL.WIndows.App">
      <uap:VisualElements DisplayName="CVA.COS_App" Square150x150Logo="Assets\Square150x150Logo.png" Square44x44Logo="Assets\Square44x44Logo.png" Description="CVA.COS_App" BackgroundColor="#f4f4f4">
        <uap:DefaultTile Wide310x150Logo="Assets\Wide310x150Logo.png">
        </uap:DefaultTile>
        <uap:SplashScreen Image="Assets\SplashScreen.png" />
        <uap:InitialRotationPreference>
          <uap:Rotation Preference="portrait" />
          <uap:Rotation Preference="landscape" />
          <uap:Rotation Preference="portraitFlipped" />
          <uap:Rotation Preference="landscapeFlipped" />
        </uap:InitialRotationPreference>
      </uap:VisualElements>
    </Application>
  </Applications>
  <Capabilities>
    <Capability Name="internetClient" />
    <Capability Name="privateNetworkClientServer" />
    <DeviceCapability Name="webcam" />
  </Capabilities>
</Package>
1

1 Answers

0
votes

If I try to use our normal code signing certificate from StartSSL to sign the package, I got the following error

If we want to sing a UWP app, the code signing certificate is needed. The certificate you got from StartSSL is used for client authentication, you can check the Enhanced Key Usage field:

Available code signing cert:

enter image description here

The cert from StartSSL:

enter image description here

See also: What is special about a code signing certificate? and Intro to certificates

------Update 11/16/2016------

Please see the Validating Certificates section at https://go.microsoft.com/fwlink/?LinkID=241478

It looks like this certificate violates the sentence I bolded in:

Verifies the value of the Enhanced Key Usage property, which must contain Code Signing and may also contain Lifetime Signing. Any other EKUs are prohibited.

Their screenshot (below) shows the enhanced keys Codesignatur and Kernelmodus-Codesignatur.

screenshot