Re: Enabling Infopath Full Trust for external office apps using internal CA Cert

Hilary Stoupa — Wed, 03 Aug 2011 18:59:35 GMT

Wow. Thank you so much for sharing this info with the rest of the community!!!!

Enabling Infopath Full Trust for external office apps using internal CA Cert

n0junk — Wed, 03 Aug 2011 18:52:28 GMT

I just struggled with this all morning and finally got it to work. Here is my knowledge dump.

Normal 0 false false false EN-US X-NONE X-NONE /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin-top:0in; mso-para-margin-right:0in; mso-para-margin-bottom:10.0pt; mso-para-margin-left:0in; line-height:115%; mso-pagination:widow-orphan; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin; mso-bidi-font-family:"Times New Roman"; mso-bidi-theme-font:minor-bidi;}

Infopath Full Trust

This will allow you to put code in your infopath form (e.g. open an excel spreadsheet from infopath) and then sign the code (Code Signing) for others with your organization to use

Tun on Full trust

In the developer Tab click on the Language option

In the Form Options window select “Security and Trust”

Select “Full Trust (the form has access to files and settings on the computer)”

Check the box for “Sign this form template”

Click the select certificate button

(see how to create cert)

How to create a cert

You can buy certs online or you can use an internal Certificate Authority (CA). The scope of this guide will not include setting up a CA.

Click Start -> Run -> type “MMC”

Add the certificate snap-in with the “My user account” option

Expand Certificates -> Personal

In the Personal Window right click on the white space and select “All Tasks” -> “Advanced Operations” -> “Create Custom Request”

In the Certificate Enrollment window click Next to proceed

Highlight “Active Directory Enrollment Policy” (selected by default) and click next

In the Template dropdown choose “Code Signing” and click next

Click on the dropdown next to details and click on the properties button

Assign your cert a name in the General Tab and the click on the Subject Tab

Under subject select “Common Name” under Type and put your alias under Value

Click on the Private Key tab

Click on the Cryptographic Service Provider dropdown and make sure that “Microsoft Enhanced Cryptographic Provider v1.0 (Signature)” is the only thing selected

Close the dropdown for Cryptographic Service Provider and expand the dropdown for Key Options

Change the key size to 2048 and check the box next to “Make private key exportable”

Click ok to close the window

Click Next back on the Certificate Enrollment window

Assign a Name location the file and select the Binary option

Click finish to close the window

Proceed to How to export/import a custom Certificate

How to export/import a custom Certificate

After creating the custom certificate request the request must be granted and the new cert imported to the Personal folder. I have had the best luck doing this by exporting the cert to a file and importing the file to the personal folder via IE

Export

With the MMC Certificate snap-in open (see above for details to open the snap-in), expand Certificates -> Certificate Enrollment Requests (may require an “F5” refresh if the window was open at time of creation) -> Certificates

Right click on the cert in the right pane -> All Tasks -> Export

Select Next in the Certificate Export Wizard to proceed

Select “Yes, Export the private key” and click next

With the “Personal Information Exchange – PKCS #12 (.PFX)” option already selected, put a check in the “Include all certifates in the certification path if possible” box and the “Export all extended properties” box - click next

Give your cert file a password and click next (e.g. P@$$w0rd)

Give the cert file a location and file name (e.g. C:/InfopathCert.pfx) and click next and finish to complete the export

Import

Open Internet Explorer

Click on Tools from the top menu (may require you to press “Alt” if the menu is hidden” -> “Internet options”

Click on the Content tab and click on the “Certificates” button

In the new “Certificates” window, click on the Import button which will start the Certificate Import Wizard

Click next in the new window to proceed

Select the certificate file you saved above (C:/InfopathCert.pfx) by browsing to the folder and changing the file type drop-down to “All Files(*.*)” and then click Next

Enter the password you created (e.g. P@$$w0rd) and check the box to mark the key as exportable and click next

Make sure that “Place all certificates in the following store” is selected and the “Personal” store is entered in the textbox and click next

Click finish to complete the import

You should now be able to see the cert in the Infopath Cert Selection above

Final Tip – Don’t forget to renew the cert before the year is up!