How to add a digital certificate to my packed XLL

[Dimitrios T]

Hello to everyone,

I am in desperate need for a solution with deployment. I decided to simply copy the packed XLL file to the target machine and launch it from the Start menu with a simple shortcut. That whole process works really well however whenever the addin starts I get a "Warning: There is no digital signature available". So my understanding is that I need somehow to provide that in my VS project. 

My question is how exactly do I do that? I want initially to test the addin without buying a certificate so I followed the steps of using sn and idasm to sign my assembly. This didn't seem to work so I tried to sign the assembly that contains the addin from the Code Signing tab but unfortunately I am using Excel.DNA.Integration which is not signed so my project does not compile. 

Any ideas how I get this warning message disappear?

Thanks

Dimitris

[Govert van Drimmelen]

Hi Dimitris,

There are different meanings of signing and signatures that might be confused here.

The first is the .NET Framework mechanisms of strong naming and signing of managed assemblies. That is not relevant to the Excel-DNA add-ins at all, since the native add-in mechanism bypasses .NET security completely.

The second meaning is the digital signing of binaries on Windows - in this case the signing of the .xll add-in. This is the signature that Excel is looking for under your security settings.

To implement this for your add-in, you first make the packed .xll file for your add-in.

Then you use the SignTool.exe utility https://msdn.microsoft.com/en-us/library/8s9b9yaz(v=vs.110).aspx to sign your .xll binary.

-Govert

---

From: exce...@googlegroups.com [exce...@googlegroups.com] on behalf of Dimitrios T [dtra...@gmail.com]
Sent: 22 January 2016 05:14 PM
To: Excel-DNA
Subject: [ExcelDna] How to add a digital certificate to my packed XLL

--
You received this message because you are subscribed to the Google Groups "Excel-DNA" group.
To unsubscribe from this group and stop receiving emails from it, send an email to exceldna+u...@googlegroups.com.
To post to this group, send email to exce...@googlegroups.com.
Visit this group at https://groups.google.com/group/exceldna.
For more options, visit https://groups.google.com/d/optout.

[Gareth Hayter]

Keep in mind that SHA1 signatures are being deprecated this month. You'll need to sign with SHA2....actually, you'll need to sign twice, once with SHA2 and then with SHA1. See here for a nice summary:

http://successfulsoftware.net/2016/01/22/software-sha1-sha2-digital-certificates/

Kind regards,

Gareth.

To post to this group, send email to exc...@googlegroups.com.

[Dimitrios T]

Thanks for your reply Govert. I must admit, I didn't look into SignTool at all. So do I definitely have to purchase a digital certificate and use SignTool to sign the XLL? Or can I use something else temporarily to do my testing?

Regards

Dimitris

To post to this group, send email to exc...@googlegroups.com.

[Govert van Drimmelen]

I think you can do it with a self-signed certificate.

See the instructions here as a start:

http://stackoverflow.com/questions/84847/how-do-i-create-a-self-signed-certificate-for-code-signing-on-windows

or

https://msdn.microsoft.com/en-us/library/windows/desktop/jj835832(v=vs.85).aspx

You might just have to add it to the Office Trust Center for it to be accepted.

-Govert

---

From: exce...@googlegroups.com [exce...@googlegroups.com] on behalf of Dimitrios T [dtra...@gmail.com]

Sent: 25 January 2016 12:49 AM
To: Excel-DNA
Subject: Re: [ExcelDna] How to add a digital certificate to my packed XLL

To post to this group, send email to exce...@googlegroups.com.

[Dimitrios T]

Hi Govert,

your help is much appreciated so far. I created my own certificate and then using pvk2pfx I created a (Personal Information Exchange) pfx file. I then used a tool called SignGUI to essentially sign my XLL file. Once I did that I installed the Addin and manually had to trust myself (the publisher) and add the certificate in the local store. That seemed to work and make the warning disappear.

What I want to do however is to have this entire process of trusting the certificates automated in my WIX installer. There seems to be a problem and the reason I am sending another post on it. 

I have the following in my WIX script:

    <Directory Id="TARGETDIR" Name="SourceDir">
      <Directory Id="ProgramFilesFolder">
        <Directory Id="Company" Name="$(var.ManufacturerName)">
          <Directory Id="INSTALLDIR" Name="$(var.ProductName)">
            <Component Id="CertificateComponent" Guid="1f59dccf-7176-4e97-afb0-e1daf013d1df">
              <CreateFolder/>
              <iis:Certificate Id="My.Certificate" StoreName="root" Overwrite="yes" Name="MY_CA"
                               Request="no" CertificatePath="Resources\myapp.pfx" StoreLocation="localMachine" />
            </Component>
          </Directory>
        </Directory>
      </Directory>

That should work however it seems that my WIX installer fails and can never install the certificate and the addin. Any ideas would be much appreciated. I am trying desperately to get to the bottom of this and have a finished product that users can trust and use without messing around with their Certificate Store. I looked at examples of Wix installers on the web with the certificate installation builtin but nothing so far that works.

Thanks

Dimitris

[Govert van Drimmelen]

Hi Dimitris,

Can you try installing into StoreName="trustedPublisher" rather than StoreName="root" ?

-Govert

---

From: exce...@googlegroups.com [exce...@googlegroups.com] on behalf of Dimitrios T [dtra...@gmail.com]

Sent: 25 January 2016 04:12 PM
To: Excel-DNA
Subject: Re: [ExcelDna] How to add a digital certificate to my packed XLL

--

You received this message because you are subscribed to the Google Groups "Excel-DNA" group.
To unsubscribe from this group and stop receiving emails from it, send an email to exceldna+u...@googlegroups.com.

To post to this group, send email to exce...@googlegroups.com.

[Dimitrios T]

Hi Govert,

after a few days of battling with the certificates WIX code I managed to make this work. Basically the problem was that I had some other certificate within the store registered and when I was trying to install my add-in I couldn't. So I removed that certificate, I recreated everything, run the installer and it finally worked. 

Thanks for all your help. It seems that certificates are particularly tricky to work with and it doesn't help that Microsoft has a lot of the tools required completely hidden.

D

To post to this group, send email to exc...@googlegroups.com.