Welcome to our community!

OnPrem Signing Certificate

Avatar
Andrew Aldridge
  • updated
  • Open

I'm trying to start a thread for us to discuss the latest bombshell that we have 6 days to provide our own code signing certificates, my previous attempt is "Awaiting Moderation" which may just be because I included a URL in the post?

While it feels very much like a final attempt to kill off the on-prem user base, there's no real benefit discussing that other than venting so I'm looking to see if anyone's research so far as turned up an affordable way of acquiring code signing certificates.

The likes of DigiCert, SSL etc seem to come out at several hundred $/year in the first year, possibly dropping from there once you own a suitable storage method for the certificate.

Azure Trusted Signing looked promising for a while at a few $ a month - but is currently only available to USA and Canada based businesses, so rules out the rest of us.

Does anyone have any other sources?

Thanks
Andrew

Replies 83
Avatar
0
eNet

First, does anyone know how to get the email field populated? Or is that necessary?  

Second, does anyone have support sessions working such that the client does not get stopped by Smartscreen and/or give the Unknown Publisher errors when trying to connect with someone?


I’ve been asking Connectwise chat support about these questions for three weeks now and the chat support person, each time I have asked for an update, tells me that the problems have each been reported and they will be resolved when development releases updated versions to fix these issues. I replied “Really???? That answer is absolutely no help at all! I wish I could have figured that answer out all by myself! Duh!!!”


Avatar
0
c g
Quote from c g

I had the same issue. The certificate was working but I got a 500 internal server error when downloading the support application. The issue was that Windows Defender on the Server put the file C:\Program Files (x86)\ScreenConnect\Bin\ScreenConnect.Client.exe into quarantine since it thought it was malware. 

Additionally I had to whitelist the folder C:\Windows\SystemTemp\ScreenConnect\ where ScreenConnect puts a temporary file when signing the support executable. Then everything finally worked again.

The executables were signed but had no timestamp in the signature. I found out myself that you have to add an entry in the appSettings section of the web.config file with key="CodeSigningTimestampServerUrl" and value="URI_OF_TIMESTAMP_SERVER". Only after this change did the signed executable have a timestamp.

All in all a complete mess and forcing people to take the most expensive way via Azure key vault, since you cannot enter the private key for code signing certificates issued today. Either you have a USB dongle with the private key or you have a HSM certificate, where you don't have the private key at all. A general signing interface would allow a command line tool to be run for singing the executable but the code signing extension does not offer that. Basically you are forced to use Azure key vault.

This is no longer working since at least version 26.1.25.9592.

The code has changed and instead of passing the timestamp server URL to the function responsible for getting the timestamp and writing the signature, null is passed and no timestamp request is even made to the timestamp server.

Avatar
1
P K.

Due to the changes introduced by ConnectWise, we were required to purchase our own EV Code Signing Certificate. We have successfully completed the implementation and configuration. The installer signing process is working correctly, and Microsoft SmartScreen properly identifies our company as the verified software publisher. However, the installer is still being flagged as a potentially unsafe file when downloaded from the Internet.

We suspect that this behavior may be related to the absence of a timestamp signature on the generated installer. I previously discussed this with CW support team and was informed that the last version where timestamping was working correctly was 25.9.9.9530.

According to the information provided, timestamping support was removed starting with version 25.9.10.9545, with the expectation that it would be restored in a future update. However, more than six months have passed since then and no update addressing timestamping functionality has been released.


Is there an expected timeline for when timestamp support will be reintroduced? We are currently running the latest available version, 26.4.3.9662, and the installer still does not receive a timestamp signature.

As a result, after downloading the installer from the Internet, users must first manually unblock the file before they can execute it without SmartScreen warnings. This significantly impacts the user experience and partially defeats the purpose of deploying an EV Code Signing Certificate.

Any information regarding the current status of timestamping support and potential workarounds would be greatly appreciated.


Customer support portal powered by UserEcho