InfoPath Dev

Hi All,

I have an InfoPath (2003) form that uses managed code (C#) and hence requires Full Trust. Installing the forms (MSI) is not a solution we can use and hence will need to digitally sign the form.

I have created a self-signed certificate (which is put into my Personal certificates). Using the security tab in Form Options I am able to select this certificate and then publish this form to a shared network. Other users can access this form and install the certificate, and all works fine.

The issue occurs when I attempt to publish the form (that has the required certificate) via another machine (that doesn't have the certificate in the Personal certificates). When I right click on the form, select Design I get 2 error messages. The first mentioning I need to publish the form and the second regarding an issue with the certificate (this is attached: error_msg.jpg). I have attempted installing the required certificate into the Personal certificates. This process is sucessful, but the certificate doesn't appear in InfoPath (i.e. security tab in Form Options).

It has been suggested that I may need to purchase an authenticated certificate, but I cannot see how this will help either, as InfoPath only seems to allow certificates that are available in the Personal certificates.

My question is how do I get around these issues, so that I can give a support engineer in a different location a form with the required certificate that they can publish on a shared network.

Any help/direction would be greatly appreciated.

One question -> why would an InfoPath solution with managed code require Full trust. It should work with Domain trust unless you are doing something specific that needs Full trust?

Full Trust is required since I am actually adding a toolbar to the InfoPath application.
Creating a toolbar through hacking the manifest file will not suffice for the work I am doing.

The issue I am having is being avoided, and seems to me it is something that just cannot be done. People seem to find this too difficult an issue and go down the path of MSI (which I stress I cannot do given the type of customer I am working with). Any help would prove invaluable.

To save people time with similar deployment issues, I have been giving an answer from an Escalation Engineer in Redmond, part of the Office Team.

<------------------------------------------------------------------------------------>

In order to sign a form, you need the private key for the certificate. This private key is not installed when you install a certificate on a machine, for the very simple reason that it would allow anyone to sign with your certificate. That would be bad. :-)



When you create a certificate with the self-cert utility, it automatically installs the private key for the certificate so it can be used to sign code. However, you cannot then move that private key to another machine. You can use these steps from the Infopath 2003 SDK to use the "makecert" utility to create a certificate with a private key stored in a .pvk file that can then be ported.



To create a certificate with the Makecert.exe utility, a trusted root certificate authority must be created first. To create the certificate authority:

Open the Command Prompt, type the following, and then press ENTER:
makecert -n "CN=TrustedRootCA" -r -cy authority -a sha1 -sky signature -m 1 -sv certRoot.pvk certRoot.cer -ss ROOT

The Create Private Key Password dialog box is displayed. Click None.
A Security Warning message is displayed stating "You are about to install a certificate from a certification authority (CA) claiming to represent: TrustedRootCA". Click Yes to install the certificate to the Trusted Root Certification Authorities store.
To create a certificate that can be used for signing, type the following, and then press ENTER:
makecert -n "CN=TestCert" -cy end -a sha1 -sky signature -m 1 -iv Certroot.pvk -ic certroot.cer -ss MY -sv MyKey.pvk MyCertificate.cer

The Create Private Key Password dialog box is displayed. Because this is just a debug and test certificate, it is recommended that you use a blank password to make the signing process simpler. To create a blank password, click None.
Once you have the PVK file, you can use the PVK Digital Certificates File Importer http://www.microsoft.com/downloads/details.aspx?FamilyID=F9992C94-B129-46BC-B240-414BDFF679A7) to install the certificate with private key on the new machine.



NOTE: Certificates generated by MakeCert and SelfCert should be used for testing only. Although they are fully valid certificates, the code signer has not gone through the validation process that a commerical certificate provider like Thawte or Verisign performs, or even the internal valdiation that a corporation running their own Certificate Server would have implemented. Trusting self-signed certifcates potentially opens you up to malicious code.

Thanks for the post! I, for one, gave up on trying to find an explanation of how to implement the certificates. I'm sure it will come in handy for many people in the future.

You're right SamDahl,

I can't follow that either. Do you have to be a rocket scientist to follow that?

Hi SamDahl,

Please help me on the below issue.

I did some changes in my infopath code and tryed to publish the form,but its given me below alert message.

The certificate selected to sign this form template is not available or is invalid,Select a valid certificate and save the form template

When i check the my form option-->Security and Trust option --> i check my view certificate ,unfortunaltelly its already expired.

So,please tell me how to renew the certifcate. Please its very urgent need ,have to deploy into the production.

Waiting for valuable response.

 Thanks

MAK

Hi MAK,

Just create a new one. When you create a new one, you may want to use the technique Mel describes in her blog post here.