How to: Add a Trusted Publisher to a Client Computer for ClickOnce Applications

 

For the latest documentation on Visual Studio 2017 RC, see Visual Studio 2017 RC Documentation.

With Trusted Application Deployment, you can configure client computers so that your ClickOnce applications run with a higher level of trust without prompting the user. The following procedures show how to use the command-line tool CertMgr.exe to add a publisher's certificate to the Trusted Publishers store on a client computer.

The commands you use vary slightly depending on whether the certificate authority (CA) that issued your certificate is part of a client's trusted root. If a Windows client computer is part of a domain, it will contain, in a list, CAs that are considered trusted roots. This list is usually configured by the system administrator. If your certificate was issued by one of these trusted roots, or by a CA that chains to one of these trusted roots, you can add the certificate to the client's trusted root store. If, on the other hand, your certificate was not issued by one of these trusted roots, you must add the certificate to both the client's Trusted Root store and Trusted Publisher store.

System_CAPS_ICON_note.jpg Note

You must add certificates this way on every client computer to which you plan to deploy a ClickOnce application that requires elevated permissions. You add the certificates either manually or through an application you deploy to your clients. You only need to configure these computers once, after which you can deploy any number of ClickOnce applications signed with the same certificate.

You may also add a certificate to a store programmatically using the X509Store class.

For an overview of Trusted Application Deployment, see Trusted Application Deployment Overview.

To add a certificate to the Trusted Publishers store under the trusted root

  1. Obtain a digital certificate from a CA.

  2. Export the certificate into the Base64 X.509 (.cer) format. For more information about certificate formats, see Export a Certificate.

  3. From the command prompt on client computers, run the following command:

    certmgr.exe -add certificate.cer -c -s -r localMachine TrustedPublisher

To add a certificate to the Trusted Publishers store under a different root

  1. Obtain a digital certificate from a CA.

  2. Export the certificate into the Base64 X.509 (.cer) format. For more information about certificate formats, see Export a Certificate.

  3. From the command prompt on client computers, run the following command:

    certmgr.exe -add good.cer -c -s -r localMachine Root

    certmgr.exe -add good.cer -c -s -r localMachine TrustedPublisher

Walkthrough: Manually Deploying a ClickOnce Application
Securing ClickOnce Applications
Code Access Security for ClickOnce Applications
ClickOnce and Authenticode
Trusted Application Deployment Overview
How to: Enable ClickOnce Security Settings
How to: Set a Security Zone for a ClickOnce Application
How to: Set Custom Permissions for a ClickOnce Application
How to: Debug a ClickOnce Application with Restricted Permissions
How to: Add a Trusted Publisher to a Client Computer for ClickOnce Applications
How to: Re-sign Application and Deployment Manifests
How to: Configure the ClickOnce Trust Prompt Behavior

Show: