自动安装：带有证书的自签名 ClickOnce 清单 >需要应用程序在客户端 PC 上的受信任根证书中安装根 CA
ClickOnce 假设使用签名证书进行分发。如果我正在开发一个主要的应用程序，我可以理解购买证书。但是，我的应用程序适用于一家小型公司，我无法证明其昂贵的合理性。
我的问题是，当我的应用程序首次安装时，如何将我的自签名根 CA 自动安装到受信任的根证书中，以便我的自签名程序不会出现问题？
我当前的自签名 CA 根和程序证书是在 Exchange 2010/IIS 7.0 和 OpenSSL 之间设置的。客户端将是远程的，所以我不想使用微软的证书颁发机构。您可以在 http://www.tekcrack.com/creating-your-own-self-signed-sans-certificate-for-exchange-2010-and-iis-70-1of3.html
有人遇到过同样的问题吗？您采取什么途径免费解决这个问题？
ClickOnce is suppose to use a signing cert for distribution. If I was developing a major app, I could understand purchasing a cert. However, my app is for a small sized company and I cannot justify the expensive.
My question is, when my app first installs, how might I install my self signed Root CA into Trusted Root Certificates automatically so there are no issues with my self signed program?
My current self signed CA Root and program cert were setup between Exchange 2010/IIS 7.0 and OpenSSL. The clients will be remote so I do not want to use Microsoft's Certificate Authority. You can see how I developed the certs at http://www.tekcrack.com/creating-your-own-self-signed-sans-certificate-for-exchange-2010-and-iis-70-1of3.html
Has anyone encountered the same problem? What route did you take to work around it...for free?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我不知道该证书是否适用于 ClickOnce 部署。您需要的是代码签名证书。我认为您可以以不到一百美元的价格从 GoDaddy 购买一个，这对于给您的客户带来拥有值得信赖的发布商的温暖感觉来说相当便宜。
如果您的客户拥有域管理员和任何类型的中央 IT 组，他们可以为您创建受信任的证书。
您无法以编程方式在用户计算机上安装证书。 ClickOnce 应用程序将不具有该级别的权限。您必须让客户安装证书。另外，如果人们可以在用户不知情的情况下安装证书，这将是一个巨大的安全漏洞。
我最后的智慧之言是——确保您的证书受到密码保护，没有人可以得到它。如果他们这样做，并且证书安装在用户计算机上的存储中，他们将能够以您的名义在用户计算机上安装应用程序。
说了这么多，我认为这篇文章会对您有所帮助：
http://msdn.microsoft.com/en-us/library/ms996418.aspx#clickoncetrustpub_topic1
I don't know if that certificate will work for ClickOnce deployment. What you need is a code-signing certificate. I think you can buy one from GoDaddy for less than a hundred bucks, which is pretty inexpensive for giving your customers that nice warm feeling of having a trusted publisher.
If your customer has a domain administrator and any kind of central IT group, they can create a certificate for you that will be trusted.
You can't install a certificate programmatically on the user's computer. A ClickOnce application will not have that level of privilege. You have to have the customers install the certificate. Plus, it would be a huge security gap if people could install certificates without the user's knowledge.
And my last words of wisdom -- be sure your certificate is password-protected, and nobody can get their hands on it. If they do, and the certificate is installed in the store on the users's computer, they will be able to install applications on the user's computer in your name.
Having said all of that, I think this article will be helpful to you:
http://msdn.microsoft.com/en-us/library/ms996418.aspx#clickoncetrustpub_topic1