InfoPath Dev

Hi I am a newbie when it comes to form signing/certificate so I need some clarifications and guidiances....

My proposed sequence of actions for signing and distributing a form:

- I want to digitally sign a form that I design before I deploy to users (> 200 users).
- The organisation I work for uses its' own Microsoft Certificate server (CA)
- CA issues me a certificate, then I use "Form Options" - Security - Form Signing - and then sign the form
- I distribute the form to the users
- I don't want these users to digitally signed the form (with data), I just want to make sure they are using MY form

My Qs are:

- When the users open my form the first time, s/he should receive a message to prompt them to install the certificate/key, right?
- Do these 100 users need to have "root certificates" installed in their PCs first? Or is it irrelevant?
- How often these certificates need to be renewed?
- To enhance the security, I want to write a separate .NET program to check if a user has MY certificate installed in their machines, is that possible? (some code guidiance will be nice, too)

Thanks for your help in advance.

Wai-man

Hi Waiman,

• Yes, they will get prompted on open to accept the certificate or trust it.
• They do not need to install the certificate to the root.
• I think it's once a year or so. Depends.
• I don't know the answer to this last question

This site shows you how to check your installed certificates, you can get the expiration date as well. (it says Vista, but it works on XP)

http://windows.microsoft.com/en-US/windows-vista/View-or-manage-your-certificates

You can also check the exp date of the certificates when in InfoPath, Form Options -> Security -> when you select/view certificate, it should show you the exp date.

To answer your last question, the form should not open unless the Certificate you used to sign the form with is used. (It is possible to use another, but a very small chance, and very complicated)

Thanks for the quick response.  The reason why I want to have a separate .NET program to check the certificate is  to avoid (although unlikely) a user creates his own InfoPath form to retrieve data.

Thanks for your reply.  Most helpful.

There are other techniques for this. You could require that the Web service authenticate the user (Windows Auth) or the form (custom certificate). You can also just encrypt the contents and decrypt in code. The chance of someone decoding your keys from a code disassembly is pretty unlikely. qRules provides an easy mechanism for encrypting data using a pin and you could add a very simple onload rule that automatically decrypts the data coming in. So long as the user doesn't have access to the XSN (i.e. browser form) this would be pretty secure. You could also just reduce the amount of data that they can pull down in one query.