4

I was recently given a VB.NET project for fixing some bugs and creating an installer for it. I was told to use Install Shield LE.

All went well with creating the install script but Windows 8 is giving me a smart screen warning when downloading the application from a web site and trying to install it.

I am aware of Windows 8 policy where popular applications get more "trust points" and become popular but the application is targeted for a fairly small audience of people therefore we can not rely on this option. Even more, people without proper knowledge would be repelled by the warning message and that could cause MS to never raise the trust for the application.

My question is, do I have to sign both - the application and the installer with a certificate? If so how do I sign the installer, as there is a signing tab for the project but I can't find one for the installer.

Bonus points if anyone can tell me if acquiring a proper certificate will remove the warning message telling this isn't a commonly downloaded file and might be dangerous from chrome/IE when downloading the application. There are many threads about this, I know, but most of them suggest adding the site to webmaster tools but that hasn't helped and we're still receiving the message

Thanks.

Christopher Painter
  • 54,556
  • 6
  • 63
  • 100
Eliah John
  • 77
  • 6
  • 1
    It is like SO reputation, you cannot promise bonus points when you only have 11 of them. Nobody will believe that you are credible when you make promises that are bogus, unsubstantiated or unprovable. Which is what the Windows 8 smart screen filter is all about, you collect trust from evidence, not from promises. Treat your customers well, avoid trying to fool them and the trust will evolve. – Hans Passant Apr 24 '13 at 11:43
  • 1
    Some details you can find here:http://stackoverflow.com/questions/12311203/how-to-pass-the-smart-screen-on-win8-when-install-a-signed-application/12312515#12312515 – Bogdan Mitrache Apr 24 '13 at 13:05
  • 1
    And here: http://blogs.msdn.com/b/ie/archive/2012/08/14/microsoft-smartscreen-amp-extended-validation-ev-code-signing-certificates.aspx – Bogdan Mitrache Apr 24 '13 at 13:06
  • Thank you for your Input, Hans, and for the links, Bodgan. I had seen both of the links still I was in doubt about how the installer handles the certificates. – Eliah John Apr 26 '13 at 07:09

2 Answers2

0

If I have read your post correctly then you are talking about an application as opposed to a website, and for that you would need a code signing certificate. Certificates that sign websites are different so first and foremost decide what it is that you are producing and want to sign.

Having decided that then you need to decide who you will use to supply your certificate. Typical sources would be VeriSign, Thwaite or Globalsign to name but three. All charge different prices but essentially do the same thing.

Once you have the certificate then the installer that you use to build your application signs the code files you select and the actual installer (msi or exe) itself.

That should eliminate the message that you now see warning people about potentially dangerous files that they are about to download.

I cannot stress enough however that you need to be clear about which type of certificate you need BEFORE you go ahead and buy one. I think from your description you are talking about a code signing certificate but do check first.

Dom Sinclair
  • 2,458
  • 1
  • 30
  • 47
  • I am, indeed, talking about code signing certificate for a desktop application. Thank you for your input! I've read that extended validation code signing certificates gain immediate trust with Win8, is this true? Also, just to clarify whether I understood you correctly, when I sign my application from the projects properties (There is a signing tab where to set my cert file), build it, then build the installer, does IS LE inherits the certificate from the application? – Eliah John Apr 24 '13 at 11:26
  • Not sure about LE ( don't have it on this machine ) but other versions of InstallShield have a place where you tell it to sign the embedded cabs, MSI and EXE (if you have one). It also takes a property for the location of PFX file (and others) and passphrase. It can't "inherit" from the application because a signed file only has the public key not the private key. – Christopher Painter Apr 24 '13 at 12:59
0

Following CAB forum regulation you will need to have an Extended Validation code signing in order to bypass the smart screen filter.

Extended Validation code signing will establish immediate trust with the machine, as you go through a more stringent validation process to obtain it! (or at least that's the rationale behind it!)

I think you can get an extended validation code signing either from SYmantec or GLobalsign.

snlpnstslocn
  • 29
  • 1