Welcome to our community!

OnPrem Signing Certificate

Avatar
Andrew Aldridge
  • updated
  • Open

I'm trying to start a thread for us to discuss the latest bombshell that we have 6 days to provide our own code signing certificates, my previous attempt is "Awaiting Moderation" which may just be because I included a URL in the post?

While it feels very much like a final attempt to kill off the on-prem user base, there's no real benefit discussing that other than venting so I'm looking to see if anyone's research so far as turned up an affordable way of acquiring code signing certificates.

The likes of DigiCert, SSL etc seem to come out at several hundred $/year in the first year, possibly dropping from there once you own a suitable storage method for the certificate.

Azure Trusted Signing looked promising for a while at a few $ a month - but is currently only available to USA and Canada based businesses, so rules out the rest of us.

Does anyone have any other sources?

Thanks
Andrew

Replies 83
Avatar
0
Nathan Oldfield
Quote from mal

All my sites gone dead.  I didn't think existing sites/endpoints would be affected, only new and reinstalled ones..  Unless SC have done some other trickery?

The certificate used to sign their code is being revoked.  I thought it was another 3 hours away.  Maybe my time conversion was off.  

Windows / defender / endpoint protection etc would be checking for revoked certificates and blocking it.  

Do you have access to a client machine by some other means so you can check the logs?  I assume the event log would have some clues. 

Avatar
0
mal

All my sites gone dead.  I didn't think existing sites/endpoints would be affected, only new and reinstalled ones..  Unless SC have done some other trickery?

Avatar
0
Nathan Oldfield
Quote from johnpl

Hello,

How did you do that? Did you buy a new certificate, used cert you already have, connected everything via Azure?

We tried adding our own custom certificate, and it crashed the webpage. I had to restart all the ScreenConnect Services just to get things back online. After the restart, the certificate showed up in the "Certificate Signing" section, but when I try to start a one-time session, I just get a runtime error / and nothing happens.

You need a code signing certificate.  Not the same as a cert you would use for website ssl etc. 

Followed the guide in the CW docs and also the steps that the cert vendor had around the CSR generation 

have you got a code signing certificate?


and have setup azure key vault as per the instructions.  We have one of the MS partner benefits package so we have azure credits but it’s very cheap anyway. 

Avatar
0
johnpl
Quote from Nathan Oldfield

Absolute PITA but finally got our certificate and now have SC updated and crisis averted..  sigh.. will be looking for alternatives before next renewal

Hello,

How did you do that? Did you buy a new certificate, used cert you already have, connected everything via Azure?

We tried adding our own custom certificate, and it crashed the webpage. I had to restart all the ScreenConnect Services just to get things back online. After the restart, the certificate showed up in the "Certificate Signing" section, but when I try to start a one-time session, I just get a runtime error / and nothing happens.

Avatar
0
Nathan Oldfield

Absolute PITA but finally got our certificate and now have SC updated and crisis averted..  sigh.. will be looking for alternatives before next renewal

Avatar
1
mal
Quote from Perry Diels

I completely share your opinion eNet. Why should we even be bothered with self signing certificates etc. ... We have purchased an application with yearly maintenance on top, against the known conditions at the time of purchase. Paying for extra's such as certificates whatsoever was never mentioned.

Our lawyer is investigating whether such a situation can just happen.

Really a PITA, I just renewed my annual subscription in April for SC.  Should hit them up for a prorata refund since the product they renewed is no longer valid..

Avatar
1
Perry Diels
Quote from eNet

Having my ondemand support customers download, unzip, and run the ScreenConnect Client exe file is not a one-click support support feature. Having to spend $300+ for a year of code signing certificate, for me to sign ConnectWise's code, is not a reasonable expectation. I'm the customer. I'm paying ConnectWise for a complete remote support program, and that is not what is being provided with this latest update.

I completely share your opinion eNet. Why should we even be bothered with self signing certificates etc. ... We have purchased an application with yearly maintenance on top, against the known conditions at the time of purchase. Paying for extra's such as certificates whatsoever was never mentioned.

Our lawyer is investigating whether such a situation can just happen.

Avatar
1
HeinerH
Quote from zaeboe

Heinz - Based on your tip, I invested 3-4 hours yesterday setting up Tactical RMM on a Hyper-V guest and migrating. (hope your weekend migration went well) Install was straightforward w/a few bumps easily ironed out with minimal Grok help. Once up and running, the web GUI is fantastic with numerous, useful features surprisingly not offered by Screenconnect. For redundancy on my most critical servers/workstations I've duplicated some agents on my Action1 account for redundancy (free up to 200 endpoints). Tactical RMM removes the endpoint and simultaneous session ceiling (and cost). I've had on-prem Screenconnect for over 10 yrs. Their last minute complicated, poorly timed code-signing requirement feels like a flagrant potentially-planned disincentive to cull or migrate on premise customers to more profitable plans. If I'm not wrong, execution couldn't have been sloppier or more obvious, esp when so many knowledgeable, security-savvy replies on this board and Reddit detail multiple ways for them to address the customziation security concern easier, cleaner, cheaper, simpler, and with adequate prep time. Truly disappointing. Compared to their cloud subscriptions, my annual SC on-prem renewal is less significant to them but, proof, there goes. I'm done. Many thanks for the referral, Heinz! I hope your recommendation helps others, too.

Hello zaeboe,

the migration of over 250 clients went absolutely smoothly. With just two lines of script in labtech, I deployed the new agents using the PowerShell installer as my final step with the old software. The connection to our Zammad ticket system is also cool. Switching at short notice was absolutely the right decision. You get two complete systems: MeshCentral and Tactical Remote Management. Monday can come ;-)

Avatar
0
rob follett
Quote from Erik van Putten

And the security issue was fixed as well. I use it as a screenconnect backup and really like it.

Thanks both Simon and Erik.

Also looking to use SimpleHelp as backup , though certainly can't afford additional expense and hassle of certificates/Azure for continued use of screenconnect and don't want to move to their cloud, so will reluctantly be forced to abandon SC if they insist on this going forward.

I am aware of both the issue and fixes re SimpleHelp via their forums (where both were covered extensively)

Also, given that my usage of screenconnect since retirement is minimal (just to monitor devices on my local network + occasional support sessions for 3 or 4 other community volunteers) I will not be running public install, just myself on my local network, with occasional on demand sessions for 3 or 4 local community volunteers on known IP addresses.

Also considering rustdesk...

Avatar
2
zaeboe
Quote from HeinerH 
Hello everyone,
We canceled our screenconnect subscription today. 
Cloud isn't feasible for us, and the short notice is outrageous. 
Especially since the way the agent is configured via certificate metadata 
has been in place for 10 years. 
Now everything has to be changed within three days, 
and over a weekend, no less. 
We're migrating all clients to Tactical Remote Management this weekend. 
It's open source. You should check it out. 
It might be an alternative for some of you. 
Such actions must hurt companies. 
And the best way to do that is through financial losses. 
Regards, 
Heinz

Heinz - Based on your tip, I invested 3-4 hours yesterday setting up Tactical RMM on a Hyper-V guest and migrating. (hope your weekend migration went well) Install was straightforward w/a few bumps easily ironed out with minimal Grok help. Once up and running, the web GUI is fantastic with numerous, useful features surprisingly not offered by Screenconnect. For redundancy on my most critical servers/workstations I've duplicated some agents on my Action1 account for redundancy (free up to 200 endpoints). Tactical RMM removes the endpoint and simultaneous session ceiling (and cost). I've had on-prem Screenconnect for over 10 yrs. Their last minute complicated, poorly timed code-signing requirement feels like a flagrant potentially-planned disincentive to cull or migrate on premise customers to more profitable plans. If I'm not wrong, execution couldn't have been sloppier or more obvious, esp when so many knowledgeable, security-savvy replies on this board and Reddit detail multiple ways for them to address the customziation security concern easier, cleaner, cheaper, simpler, and with adequate prep time. Truly disappointing. Compared to their cloud subscriptions, my annual SC on-prem renewal is less significant to them but, proof, there goes. I'm done. Many thanks for the referral, Heinz! I hope your recommendation helps others, too.


Customer support portal powered by UserEcho