ClickOnce - 可以将代码签名证书添加到现有部署吗？
假设我们部署了一个应用程序的 2.0 版，并且已经有大约 3000 个用户在运行该应用程序。
到目前为止，应用程序尚未签名（由 VS 自动生成的证书签名）。
用户正在使用.NET 2.0。
现在我们想要部署一个新版本，该版本将使用 tucows 的证书进行签名。下面的答案之一表明，如果我们的目标是 .NET Framework 2.0，更改代码签名证书将“破坏”应用程序的身份。这意味着什么？
如何向现有部署添加新的代码签名证书？
通知所有用户从头开始（或从新 URL）重新安装应用程序是不可能的。
( 编辑：这是以前的要求，现在无效：
我想确保现有用户根本无法看到更新（他们不应该收到新版本可用的通知），而所有新用户都会首次安装时收到签名版本。仅仅签署部署不应成为打扰现有用户的理由。 ）
Let's say we have version 2.0 of an application deployed with around 3000 users already running the application.
So far, the application was unsigned(signed by some auto generated certificate from VS).
The users are using .NET 2.0.
Now we would like to deploy a new version that will be signed using a certificate from tucows. One of the answers below indicates that in case we are targeting .NET Framework 2.0, changing a code signing certificate would "break" the identity of the application. What does this mean?
How can one add a new code signing certificate to existing deployment?
Notifying all the users to reinstall the application from scratch (or from a new URL) is not possible.
(
EDIT: this was previous requirement, is not valid now:
I would like to ensure that the existing users will not be able to see the update at all (they should not receive notification that a new version is available), while all new users will receive the signed version when they are installing for the first time. Just signing the deployment should not be a reason to bother existing users.
)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我刚刚找到一篇很好的文章，深入解释了这个问题：
这适用于将证书从临时证书更改为受信任的证书提供商以及过期的证书。
他们可能会收到以下错误：
+ 部署标识与订阅不匹配。
解决方案也是让.NET 2.0用户重新安装整个clickonce应用程序，这是不可行的
另一个解决方案是推送 .NET 3.5 SP1 作为先决条件 - 这无论如何都会触发重新安装，并且下载量很大。
链接：http://social. msdn.microsoft.com/Forums/en/winformssetup/thread/1217520d-6dc4-4fb1-83d1-0fa148d60e5d
在 .NET 2.0 的情况下破坏应用程序意味着现有用户在安装更新时将收到错误，或者根本看不到更新。
它链接到一个帖子，其中包含可以为 .NET 2.0 用户修复应用程序的源代码：
http://robindotnet.wordpress.com/2009/03 /30/clickonce-and-expiring-certificates/
更新过程包括使用与过期证书具有相同密钥的证书重新签署中间更新、发布卸载应用程序的中间更新并强制安装新版本的。
非常痛苦！
I just found an excellent post explaining the issue in depth:
This applies to both changing of certificate from temporary to a trusted certificate provider and to expired certificates.
They may receive the following error:
+ The deployment identity does not match the subscription.
The solution is also to let the .NET 2.0 users re-install the whole clickonce application, which is not feasible
Another solution is to push .NET 3.5 SP1 as a prerequisite - which triggers reinstall anyway and is a huge download.
Link: http://social.msdn.microsoft.com/Forums/en/winformssetup/thread/1217520d-6dc4-4fb1-83d1-0fa148d60e5d
Breaking the app in case of .NET 2.0 means that the existing users will get an error when installing the update, or will not see the update at all.
It links to a post including source code that can fix the application for .NET 2.0 users:
http://robindotnet.wordpress.com/2009/03/30/clickonce-and-expiring-certificates/
The update process lies within re-signing an intermediate update with a certificate with the same key as the expiring certificate, publishing the intermediate update that uninstalls the application and forcing an install of the new version.
Very painful!
是的，这将 100% 有效。如果再次下载程序，新的签名当然会生效。不过，只有下载/更新了程序，签名才不会影响当前版本的用户。
如果您有自动更新，他们会得到它，但这是给现有用户带来麻烦的一个原因，因为它表明您的应用程序现在更安全，因为他们知道它现在来自您。
Yes, this will work 100%. The new signing will of course take affect if the program is downloaded again. The signing should not affect users with a current version though, only if the program is downloaded/updated.
If you have auto update, they will get it, however this is a reason to bug existing users, as it shows your application is now more secure as they know it now comes from you.
正如凯尔所说，如果你小心的话，它就会起作用。 （当然还要发布完全相同的版本）
警告：现有用户需要至少拥有 .NET 3.0 SP2 或 .NET 3.5 SP1。
原因：在此之前，签名被视为应用程序的一部分身份并更改它会破坏已安装用户群的应用程序。
但请亲自尝试这些事情，很容易通过一个小型项目来完成，您只需不断发布到您自己的计算机上的共享，并尝试在发布之间进行签名等。
As Kyle said, it will work if you're careful. (and of course publish the exact same version)
Caveat: The existing users need to have at least .NET 3.0 SP2 OR .NET 3.5 SP1.
Reason: Before this, the signature was considered part of the app's identity and changing it would break the app for the installed base of users.
But please try these things out for yourself, easy to do with a mini-project that you just keep publishing to a share on your own machine and try signing etc between releases.