对Visual Studio 2012 VSIX扩展进行数字签名

Question

I am trying to sign a Visual Studio 2012 extension that is packaged as a VSIX file.

I have followed the instructions at http://www.jeff.wilcox.name/2010/03/vsixcodesigning/ ; however, I am interested in performing signing without specifying a pfx file and password.

For example, if I were to call 'signtool.exe', my command line would be:

"signtool.exe" sign /n MySubjectName /t 'http://timestamp.verisign.com/scripts/timstamp.dll' /d "MyDescription" MyPackage.vsix

I understand that this command does not work with VSIX files, though it does work for an MSI archive.

With this command, I do not need to specify a password or pfx file when calling signtool. The best installed certificate is selected, using the specified subject MySubjectName .

Following the code on Jeff's Blog , the signing step requires pfx file name and password to be defined to create the X509Certificate2 used in signing:

 private static void SignAllParts(Package package, string pfx, string password, string timestamp){
  var signatureManager = new PackageDigitalSignatureManager(package);
  signatureManager.CertificateOption = CertificateEmbeddingOption.InSignaturePart;

  /*...*/

  signatureManager.Sign(toSign, new System.Security.Cryptography.X509Certificates.X509Certificate2(pfx, password));
}

Is there any API involving PackageDigitalSignatureManager that might let me find a X509Certificate based on MySubjectName so that I can sign against that?

Answer 1

I've solved this by iterating over the certificates found in the current user's store. I filter by the issuer name and take only valid certificates, then I loop over the matching certificates and return the first one which matches also the subject name:

public static X509Certificate2 Find(string issuer, string subject)
{
    var certStore = new X509Store (StoreName.My, StoreLocation.CurrentUser);
    certStore.Open (OpenFlags.ReadOnly);
    var certCollection = certStore.Certificates.Find (X509FindType.FindByIssuerName, issuer, true);

    foreach (var cert in certCollection)
    {
        if (cert.FriendlyName == subject)
        {
            return cert;
        }
    }

    return null;
}