简体繁体 English

当安装WPF应用程序时计算机识别受信任的/未知的发布者时，它如何工作？

[英]How it works when computer recognize trusted/unknown publisher when install a WPF App?

原文 2017-03-11 20:53:57 8 2 wpf/ security/ clickonce/ policy/ verisign

I am working on a WPF App but could not make it as a trusted App after publishing it with clickonce. 我正在使用WPF应用程序，但是使用clickonce发布它后却无法使其成为受信任的应用程序。 I looked many post with similar issues, signed the clickonce manifest, installed certificate, created test certificate and finally made the App trusted by my own computer. 我看了很多有类似问题的帖子，签署了clickonce清单，安装了证书，创建了测试证书，最后使我的计算机信任该应用程序。 However, when I install the App on other computers, it is still not trusted by those machines. 但是，当我在其他计算机上安装该应用程序时，这些计算机仍然不信任该应用程序。 Does it mean I should ask every user who use my App install the same certificate (.cer file) first? 这是否意味着我应该要求使用我的应用程序的每个用户首先安装相同的证书（.cer文件）？ But even after installing the certificate and recognizing the publisher name, some computers still prompt security alert like "Windows protected your PC". 但是，即使在安装证书并识别发布者名称之后，某些计算机仍会提示安全警报，例如“ Windows保护了您的PC”。

So I wondered, how it works when the computer system recognize trusted/unknown publisher? 所以我想知道，当计算机系统识别出受信任/未知的发布者时，它如何工作？ As my App is not a commercial product, and it runs offline most of the time (I only have a MySql database on a CPanel provided by Godaddy to store user login information and some user input data), so besides purchasing a valid certificate, is there is any other way to work around? 由于我的应用程序不是商业产品，并且大多数时候都离线运行（我在Godaddy提供的CPanel上只有一个MySql数据库，用于存储用户登录信息和一些用户输入数据），因此除了购买有效的证书外，还有其他解决方法吗？ If there is, what are the appropriate ways to do it? 如果存在，有什么合适的方法来做到这一点？

Can anyone explain a little bit or provide any source? 谁能解释一下或提供任何消息来源？ Thanks in advance! 提前致谢！

2 个解决方案

The certificate that was used to sign the ClickOnce application must be configured in the Trusted Publishers certificate store on all user machines. 必须在所有用户计算机上的Trusted Publishers证书存储中配置用于签署ClickOnce应用程序的证书。

Also the certificate must be purchased from a trusted authority that is a member of the Microsoft Trusted Root Certificate Program: https://social.technet.microsoft.com/wiki/contents/articles/37425.microsoft-trusted-root-certificate-program-participants-as-of-march-9-2017.aspx 此外，还必须从Microsoft可信根证书计划的成员的可信机构购买证书： https : //social.technet.microsoft.com/wiki/contents/articles/37425.microsoft-trusted-root-certificate-程序参与者截至2017年3月9日.aspx

Please refer to the following link for more information about this. 请参考以下链接以获取更多信息。

WPF Application Deployment using ClickOnce with trust certificate 使用ClickOnce和信任证书进行WPF应用程序部署

You mentioned "Windows protected your PC" so we're most probably talking about a SmartScreen issue here. 您提到“ Windows保护了您的PC”，因此我们很可能在这里谈论SmartScreen问题。 RobinDotNet explained the oddities of ClickOnce and Windows SmartScreen in all detail in her blog posts Windows 8 and ClickOnce : the definitive answer and Windows 8 and ClickOnce : the definitive answer revisited . RobinDotNet在她的博客文章Windows 8和ClickOnce（确定的答案）以及Windows 8和ClickOnce（确定的答案）中详细解释了ClickOnce和Windows SmartScreen的怪异之处。

As mm8 pointed out in his answer you need a certificate from a valid Certificate Authority. 正如mm8在他的答案中指出的那样，您需要来自有效证书颁发机构的证书。
Besides signing the manifests you need to sign the application executable as well. 除了签署清单之外，您还需要签署应用程序可执行文件。 Since you have a WPF application you will have to do this AfterCompile (at least this was true for VS2012). 由于您具有WPF应用程序，因此必须执行AfterAfterCompile（至少对于VS2012是这样）。
My favourite part: You need to earn some magical reputation by people selecting the "Run anyway" option. 我最喜欢的部分：您需要通过人们选择“仍然运行”选项来赢得一些神奇的声誉。 For our ClickOnce application the SmartScreen message went away after a few days. 对于我们的ClickOnce应用程序，SmartScreen消息在几天后消失了。