Full-Trust and Internet Zone Workarounds?

Hi all,

My application requires full trust, but it's just a freeware application that I want anyone to be able to install from my web site.

At this point the only way to install it from my site is to add the site to your "Trusted Sites" in IE. This, obviously, is less than ideal for Joe User.

Is there any way we can get around this Could I, for example, allow them to download a copy of the deployment files and run them from a local folder, then have it check my web site for updates Or would the updates themselves mean that the site needs to be trusted

It seems that for a little free application like mine I'm going to be forced away from ClickOnce, which is disappointing.

Matt


Answer this question

Full-Trust and Internet Zone Workarounds?

  • TonMekking

     Sameer Murudkar wrote:
    certmgr.exe tool ships with the Frameowork SDK and possibly with Platform SDK. certmgr.msc is the Certificates snapin that ships with the OS.


    That mustn't include C# Express beta 2, then, 'coz I definitely don't have certmgr.exe.

  • SMOwais

    Hi Matt, in the final RTM release the restrictions around prompting when running from internet zone are being relaxed. So you will be able to publish your app that is signed with a private key not necessarily signed by a certificate in Trusted Root and get users to run it after accepting high risk prompt.

    In Beta2 though you will need to either sign with a trusted certificate, or ask users to add your private cert to their cert store. There's a good article on this at http://msdn.microsoft.com/library/default.asp url=/library/en-us/dnwinforms/html/clickoncetrustpub.asp.

    Regards,
    Sameer

  • salim_555

    You are right. The express SKUs don't inclued all SDK tools. You can get the full SDK at http://www.microsoft.com/downloads/details.aspx FamilyId=41070791-8912-4F94-AC46-7CE0E386D5C9&displaylang=en

    This should contain certmgr.exe.

    Thanks,
    Sameer



  • Krazon

    Thanks for the reply, Sameer.

    I have a lot of reading ahead of me - I know pretty much nothing about code-signing etc.

    Do I need to sign my actual exe I know that the project properties in C# Express has a checkbox for "Sign the ClickOnce manifests" which is checked, but there's also "Sign the assembly" which is unchecked. Do I need to sign both

    I'll have a read of the article. Thanks again.

  • rowlandk

     Sameer Bhangar wrote:
    Hi Matt, in the final RTM release the restrictions around prompting when running from internet zone are being relaxed. So you will be able to publish your app that is signed with a private key not necessarily signed by a certificate in Trusted Root and get users to run it after accepting high risk prompt.


    Hi gang,

    Just digging up this old thread. I don't have a machine to test this on right now - has the ClickOnce story improved in the RTM version like Sameer said it would Can I install a full-trust ClickOnce-deployed application without having to add the Url to my Trusted Sites

  • Ashton

    Ok, I have read, and I think understood, that article.

    One thing that keeps popping up is "certmgr.exe". I have a "certmgr.msc" on my PC but no "certmgr.exe". Obviously they're the same thing (or near enough), but do I need something in particular installed to have the exe file

    And my big question: What's the easiest way to get my public key into the Trusted Publishers store on users' machines These are users out on the net, not machines in my company or anything.

    Cheers,
    Matt

  • Nicolas Webb

    Hi,

    certmgr.exe tool ships with the Frameowork SDK and possibly with Platform SDK. certmgr.msc is the Certificates snapin that ships with the OS.  

    certmgr.msc" on my PC but no "certmgr.exe". Obviously they're the same thing (or near enough), but do I need something in particular installed to have the exe file

    You can use the certmgr tool to add certs to Trusted Publisher, Root etc.
    certmgr.exe -del -n "ClickOnce Test" -c -s -r localMachine TrustedPublisher

    replace localmachine with curretUser for the user store.

    You can also use classes in
    System.Security.Cryptography.X509Certificates Namespace to programatically add certificates to the store.

    See http://msdn2.microsoft.com/library/ztkw6e67(en-us,vs.80).aspx

    Thanks,
    Sameer





  • Full-Trust and Internet Zone Workarounds?