Signing a Excel/VSTO project without pfx file

Question

I have a VSTO project which combines C# and Excel. My employer requires me to sign this using a certificate for which I do not have a pfx file, I only have the certificate on a chip card.

I have read most manuals and questions asked here on signing VSTO, but all somehow assume I have the pfx file. My setup in Visual Studio is the following:

„Sign the ClickOnceManifest“ is checked, using „Select from Store„ the certificate from a chipCard is selected
„Sign the Assemly“ is checked. I do not have the pfx file, so I hit „New“ and created a certificate called assemblySigningCertificate.pfx (this might be a completely bogus step, but that's the only pfx I get)

after publishing the project, I run a script that updates the signatures using mage.exe such as

set AppPublishPath=publish
set AppPublishVersionPath=publish\Application Files\diagramUnifier_1_0_0_0

copy bin\Debug\*.dll "%AppPublishVersionPath%"
copy bin\Debug\*.dll.config "%AppPublishVersionPath%"
copy bin\Debug\*.exe "%AppPublishVersionPath%"

mage.exe -update "%AppPublishVersionPath%\diagramUnifier.dll.manifest"  -ch "… certificate hash from certmgs.msc "
mage.exe -update "%AppPublishVersionPath%\diagramUnifier.vsto"  -appmanifest "%AppPublishVersionPath%\diagramUnifier.dll.manifest" -ch "… certificate hash from certmgs.msc "
mage.exe -update "%AppPublishPath%\diagramUnifier.vsto"  -appmanifest "%AppPublishVersionPath%\diagramUnifier.dll.manifest"  -ch "… certificate hash from certmgs.msc "

Once all this is done, I install the VSTO and run the xlsm file. I receive a "SignatureDescription could not be created from the signature algorithm supplied" error pointing to the VSTO file. Details of the error provide only a stackTrace, nothing else.

My questions are:

is it even possible to sign a VSTO project without a certificate for which I have a pfx file?
if I don’t have the pfx file, is it the right thing to create a new certificate in the “Sign the assembly” section of settings
am I doing something else entirely wrong?

Any help is much appreciated, Daniel

Hyrein Hyrein · Accepted Answer · 2017-05-22T07:41:33

Problem: When a certificate is created by using selfcert.exe, it's private key cannot be exported. The export wizard of the Windows certificate console says "the associated private key is marked as not exportable".

Solution version 1: Use makecert.exe with the "-pe" option to create and store the certificate with an exportable private key:

makecert -r -pe -n "CN=Your Name" -b 01/01/2000 -e 01/01/2099 -eku 1.3.6.1.5.5.7.3.3 -ss My

Then you can export the certificate from the Windows certificate store, including the private key.

Note: Old versions of makecert.exe do not support the "-pe" option. The .NET Framework SDK 2.0 and the October 2002 version of the Platform SDK (build 3718.1) contain a new version of makecert.exe (5.131) that supports the "-pe" option. (The .NET Framework SDKs 1.0 and 1.1 both contain old versions of makecert.exe that do not support the "-pe" option).

Solution version 2: The following commands can be used to create a PFX file (PKCS #12) that contains the a self-signed certificate together with the associated private key:

makecert -r -n "CN=Your Name" -b 01/01/2000 -e 01/01/2099 -eku 1.3.6.1.5.5.7.3.3 -sv selfcert.pvk selfcert.cer
cert2spc selfcert.cer selfcert.spc
pvkimprt -pfx selfcert.spc selfcert.pvk

The last command (pvkimprt -pfx) creates the file selfcert.pfx. This PFX file can then be imported into the Windows certificate store and used for code signing. (makecert.exe and cert2spc.exe are part of several Microsoft SDKs, e.g. the Platform SDK or the DotNet SDKs, which can be downloaded from microsoft.com. pvkimprt.exe can be downloaded individually from Microsoft.)

Signing a Excel/VSTO project without pfx file

2 Answers