How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction) - Maxim

How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

In previous post I wrote about running WPF-XBAP application on client machine in "Full-Trust Mode".

clip_image002

That worked fine and the post was helpful (I know this from post's talk-backs).

I described how to generate security certificate and how to install it on client machine (thru IE options).

clip_image004

Recently, I worked with XBAP deployment files and required to copy them to new IIS server, during the process I've forgotten to include certificate (ext: "cer") file. I tried to open the application from client machine (in IE or Firefox) and got error message, that tells about security restrictions and that client has refused XBAP application in full-trust mode.

clip_image006

clip_image008

I know another way to generate certificate file without using MS Visual Studio and I'll show it here.

Some Introduction…

What are "deployment files"? – XBAP application BUILD generates assemblies and other resources that required running XBAP application. These files can be placed on IIS virtual folder and being downloaded to remote client machine by using supported Internet browser (IE or Firefox).

To see which files will be included in deployment folder go to "Publish" tab in project settings form and click on "Application Files":

clip_image010

To see options for deployment and how the setup page will look go to "Publish" tab in project settings form and click on "Options":

clip_image011

Check option: "Use '.deploy' file extension". - This is helpful for full-trust mode (some machines don't allow downloading assembly files like EXE and DLL):

clip_image013

If you want to include some additional files for application deployment, go to "Publish" tab in project settings form and click on "Prerequisites":

clip_image015

"Prerequisites" - setup-package files like .Net 2.*-3.* or Windows-Installer 3.*:

clip_image017

To generate deployment files and to publish them in selected folder click "Publish Now" in "Publish" tab in project settings form and click on "Prerequisites":

clip_image019

"Publish Now" generates these files:

clip_image021

"index.htm" is a deployment page, which was build with two options to run XBAP (Click-Once) application. "Run" option opens setup dialog (in case that application runs at first time or deployed with as new version), "launch" opens XBAP directly (without the installation process):

clip_image023

Usually I copy certificate file into this directory and place a link for download on "index.htm", but what can I do if I've forgotten to create the certificate file and already copied deployment files to client's IIS server and I don't have MS Visual Studio to create the new one from sources or event don’t have any sources (project code source files)? Answer: I can extract certificate into file from deployment executables. I can extract it from "setup.exe" file or from original "EXE" or "DLL" file if it wasn’t converted into other unknown file type.

I'll show ho to extract certificate from "setup.exe" (this file includes the same certificate as XBAP-Application EXE files).

1. Go to deployment folder and do right-click on "setup.exe" file:

clip_image025

2. Open "Properties" form and go to "Digital Signatures" tab page, select included digital signature and click on "Details":

clip_image027

3. Click "View Certificate" in "General" tab page:

clip_image029

4. Click on "Copy to File" in "Details" tab page:

clip_image031

5. Proceed with opened "Certificate Export Wizard":

(5.1)

clip_image033

(5.2)

clip_image035

(5.3) you can place extracted "cer" file in deployment folder for future use:

clip_image037

(5.4)

clip_image039

When you'll finish with wizard you'll get "cer" file:

clip_image041

See previous post with instructions that will help you with certificate installation. I found this post that also describes how to run XBAP in Full-Trust mode.

(I'm "cooking" some light application that will help to install certificates automatically on user machines, when I'll finish it, I'll write the post with all sources)

Hope this post was helpful ;-)

Comments

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Tuesday, April 22, 2008 9:44 AM by Subindev

Thanx Maxim,

i was able to create certificate in my iis, website. How this will be installed in client machine's web browser????

i am expecting a reply from u...

Thanks..

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Tuesday, April 22, 2008 6:59 PM by Maxim

Manually, or by Script...

Manually: put some link to download certificate from server to client machine and user will install it manually by doing right-click on downloaded "cer" file and pressing "install" in context menu.

Script: don't know yet, but sure that exists somewhere, our applications are running on Intranet so certificate is installed manually, I think to build some small feature for auto-install, then I'll post it's code. For now, you can google for it, I'll appreciate if you'll update, if you'll find it.

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Wednesday, April 23, 2008 9:12 AM by Subindev

Manually i have done it and its workig properly in client machine....

i am looking for an automatic installation it...

Thanx for ur help and support....

i will update if i got any solution......:)

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Wednesday, April 23, 2008 4:11 PM by subindev

Hi Maxim,

i am successfully automated the installation of certificate in to ie's stores.... see this code snippet

try

           {

               WebClient web = new WebClient();

               byte[] b = web.DownloadData(@"mymachine/.../key.cer");

               X509Certificate2 cert = new X509Certificate2(b);

               X509Store store = new X509Store(StoreName.AuthRoot, StoreLocation.LocalMachine);

               store.Open(OpenFlags.ReadWrite);

               store.Add(cert);

               store.Close();

               store = new X509Store(StoreName.TrustedPublisher, StoreLocation.LocalMachine);

               store.Open(OpenFlags.ReadWrite);

               store.Add(cert);

               store.Close();

               Console.WriteLine("Certificate Successfully Installed...!");

           }

           catch (System.Exception ex)

           {

               Console.WriteLine(ex.Message);

           }

make this as c# a console application..

this exe will automate the installation of certificate.

i know an executable is not a better solution..

me still looking for a scripting solutio for automatic installation of certificate.

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Wednesday, April 23, 2008 5:30 PM by Maxim

Good Job!

I've tested your code, works fine.

The disadvantage is that client have to use EXE file. You can make "click-once" deployment page for EXE. Of course if you decided to use EXE why to continue using XBAP with "full-trust"? - Just to make an illusion of working with browser application...

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Thursday, April 24, 2008 6:49 AM by Subindev

" You can make "click-once" deployment page for EXE"-- how to do this???

My Xbap is communicating with a wcf service, to make it possible xbap might run in full trust mode..., thats y i am continuing with XBAP.

i have created an exe only for minimizing the effort in client side ie., installation of certificates in two different store's.

Thanks for continues response....

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Friday, July 25, 2008 6:32 AM by Su

Great... thank u...

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Friday, September 05, 2008 3:29 AM by Chetan Deshmukh

What is the use of Index.htm..? Are we supposed to call it from any page like Publish.htm or it automatically gets called by which certificate gets automitically gets installed.

I created a setup to Publish and  can see the setup.exe. I can also see the certificate and I kept the certificate in the application folder but when I access the Publish page and clicl on Run, It starts the setup.exe but do not install certificate.

      Please let me know if I am missing any setting which not let the setup.exe to access the certificate due to which the certificate not get installed.

Thanks,

Chetan Deshmukh

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Thursday, October 16, 2008 6:14 AM by ...

Thank you for valuable information.

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Sunday, November 02, 2008 7:37 PM by Antony

If we already have installed our xbap version(say version 1) in a client machine with certification, and if we try to install a same application with different version, it doesnt work. Certification failed. It always shows the error "Trust not granted" . We had to manually uninstall the certification and have to install it again. Is there any possible to overcome this problem.

I am expecting the reply....

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Tuesday, November 04, 2008 5:44 PM by Maxim

Antony,

This is known problem. Each certificate is embedded in application assembly, if you'll change the # of version it will be useless, I don't know the exact reason for that, but this works like this.

It's not required to change the # of version for assembly, you can change the # of version for file only; otherwise you have to install new certificate.

See comment from "Wednesday, April 23, 2008 4:11 PM by subindev" with code that you may use to install new certificate(s). Build some light tool that supposed to install certificates.

PS: I'm preparing some post about all problems with certification and XBAP deployment, stay updated.

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Thursday, November 06, 2008 6:16 AM by ...

The topic is quite curious, i must say

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Friday, December 05, 2008 9:12 AM by Saurabh

Hi subindev and all,

The post by subindev on Wednesday, April 23, 2008, tell how to install the certificate in client machine programmatically. I done this successfully but it is only working in the my machine . if someone else tries to access the url then the "Trust Not Granted" is comming. I cant figure it out . Do anyone knows why ??

Thanks

Saurabh

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Monday, December 29, 2008 10:51 AM by Saurabh

try

          {

              WebClient web = new WebClient();

              byte[] b = web.DownloadData(@"mymachine/.../key.cer");

              X509Certificate2 cert = new X509Certificate2(b);

              X509Store store = new X509Store(StoreName.AuthRoot, StoreLocation.LocalMachine);

              store.Open(OpenFlags.ReadWrite);

              store.Add(cert);

              store.Close();

              store = new X509Store(StoreName.TrustedPublisher, StoreLocation.LocalMachine);

              store.Open(OpenFlags.ReadWrite);

              store.Add(cert);

              store.Close();

              Console.WriteLine("Certificate Successfully Installed...!");

          }

          catch (System.Exception ex)

          {

              Console.WriteLine(ex.Message);

          }

I added this code at Application_startup for the XBAP application. But the problem is that as soon as the application starts it needs trust to run the methods of System.Security.Cryptography.X509Certificates namespace. So the code in Application_startup throws error. any other way to do this apart from doing it at Application_startup.

Thanks

Saurabh

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Sunday, January 11, 2009 8:13 AM by Dheeraj

Hi All,

I am new to xbap but I am currently stuck in the deployment aspect. This article provides a detailed step by step but for me it fails on the certificate. To describe my xbap, i need it to launch word/outlook on client machine which will be a link through our intranet portal. I did create the app and works fine on my machine since its running locally. Now when I am ready to deploy to our test instance, I am stuck at certificate part and confused as to if I need to purchase a root certificate or can i create my own and use it to deploy in production?

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Sunday, January 11, 2009 9:29 PM by Maxim

Dheeraj,

XBAP app. that requires access to OS resources that are restricted from web-browser must be provided with certificate.

This post describes how to extract certificate from signed assembly. See another post with explanations how to create signed XBAP: blogs.microsoft.co.il/.../wpf-xbap-as-full-trust-application.aspx.

Good Luck.

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Monday, January 12, 2009 9:04 AM by June Hyoung , Son

I am realy Thank you.

Thank you very much.

Great !!!

You should see my history in Blog.

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Tuesday, January 13, 2009 11:09 AM by Maxim

You're Welcome :)

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Friday, February 20, 2009 11:35 AM by Satyendra

Hi,

I brought the digital certificate and installed it in my machine. when I open excel my macro working fine in macro security sets to very high. But my requirment is I open to open that .xla file from vb.net windows application. while doing this excel throwing an error that security is very high. So excel can't open this macro.

How can I solve this issue. Any suggestions are very helpfull for me.

Thanks

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Friday, February 20, 2009 11:40 AM by Satyendra

Hi,

I am unable to open digital certified xla from vb.net application. while opening it from excel I can. But through program I am unable to open it while security sets to very high.

Dim Proc As New System.Diagnostics.Process

Proc.StartInfo.WorkingDirectory = folderName

Proc.StartInfo.FileName = "myKMacro.xla"

Proc.Start()

Thanks

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Sunday, February 22, 2009 10:23 AM by wirat

i found solution automatically install certificate.

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Sunday, February 22, 2009 3:50 PM by Maxim

Hi Wirat,

If you have such solution and want to share it, I'll be glad to publish it in my blog (with reference to you or to your blog/source).

Thanks.

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Sunday, February 22, 2009 6:50 PM by wirat

Example

1. i create console application and coding following below and build to "InstallerCertificates.exe"

   static void Main(string[] args)

       {

           try

           {

               if (args.Length > 0)

               {

                   Console.WriteLine("Installer Certificates 1.0 ............");

                   WebClient web = new WebClient();

                   byte[] b = web.DownloadData(args[0]);

                   X509Certificate2 cert = new X509Certificate2(b);

                   X509Store store = new X509Store(StoreName.AuthRoot, StoreLocation.LocalMachine);

                   store.Open(OpenFlags.ReadWrite);

                   store.Remove(cert);

                   store.Add(cert);

                   store.Close();

                   store = new X509Store(StoreName.TrustedPublisher, StoreLocation.LocalMachine);

                   store.Open(OpenFlags.ReadWrite);

                   store.Remove(cert);

                   store.Add(cert);

                   store.Close();

                   Console.WriteLine("Certificate Successfully Installed...!");

               }

           }

           catch (System.Exception ex)

           {

               Console.WriteLine(ex.Message);

               Console.ReadLine();

           }

       }

2. i go to folder C:\Program Files\Microsoft SDKs\Windows\v6.0A\Bootstrapper\Packages\

   and copy WindowsInstaller3_1 and rename to "WindowsInstallerCertificates" and copy "InstallerCertificates.exe"

   paste to this folder.

3. i modify Product.xml following

   <?xml version="1.0" encoding="utf-8" ?>

<Product

 xmlns="schemas.microsoft.com/.../bootstrapper"

 ProductCode="MyInstallerCertificates"

>

   <!-- Defines list of files to be copied on build -->

   <PackageFiles CopyAllPackageFiles="true">

  <PackageFile Name="InstallerCertificates.exe"/>

</PackageFiles>

   <!-- Defines how to invoke the setup for the Windows installer Certificates redist -->

   <Commands Reboot="Immediate">

       <Command PackageFile="InstallerCertificates.exe"

Arguments= 'wirat/.../WpfBrowserApplication1_TemporaryKey.pfx'

                EstimatedInstallSeconds="30" >

           <ExitCodes>

               <ExitCode Value="0" Result="Success"/>

               <ExitCode Value="1641" Result="SuccessReboot"/>

               <ExitCode Value="3010" Result="SuccessReboot"/>

               <DefaultExitCode Result="Fail" FormatMessageFromSystem="true" String="GeneralFailure" />

           </ExitCodes>

       </Command>

   </Commands>

</Product>

4. i modify Package.xml in folder "en" to

  <?xml version="1.0" encoding="utf-8" ?>

<Package

 xmlns="schemas.microsoft.com/.../bootstrapper"

 Name="DisplayName"

 Culture="Culture"

>

   <PackageFiles>

       <PackageFile Name="eula.txt"/>

   </PackageFiles>

   <!-- Defines a localizable string table for error messages-->

   <Strings>

       <String Name="DisplayName">Windows Installer Certificates</String>

   </Strings>

</Package>

5. i goto project wpf browser=>properties=>publish=>prerequisites

  and check "Create setup program to install prerequisite components"

  and select -Windows Installer 3.1

                  -.NET Framework 3.5 SP1

                  -Windows Installer Certificates (My bootstrapper)

  and check Dowload prerequisites from the same location as my application.

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Monday, March 23, 2009 9:12 AM by DVC

I have done as you guided but Windows Installer Certificates does not appear in wpf browser=>properties=>publish=>prerequisites

Please tell detail

Thanks in advance

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Wednesday, March 25, 2009 4:22 AM by wirat

Your must do following step in example 2-5, after that your can see.

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Thursday, March 26, 2009 5:58 PM by ManuelFelicio

Hi, turns out that my TSTSRV2003 certificate had an extension about revocation lists, which pointed to tstsrv2003.mydomain.com/.../tstsrv2003.crl

Well.. to begin with.. i didnt even have a certenroll folder there, so i had to create it, copy the tstsrv2003.crl file (it was in Windows/System32/CertEnroll/).

Then i had to change the settings of that folder, to work without SSL, because my computer  tried to do a HTTP GET through port 80, instead of HTTPS through port 443.

I figured out because i opened the IIS log files and noticed some HTTP 403 errors being sent to my computer when trying to make HTTP GET of CertEnroll/TSTSRV2003.crl.

Still.. it was hard to tell whats going on because presentationhost.exe simply crashes and doesn't show any message at all.

Happy coding everyone, Bye.

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Thursday, April 09, 2009 11:46 AM by V6SYNCRO

Anybody got an example of loading the certificates automatically using VB .NET?

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Wednesday, April 15, 2009 5:29 AM by Dao Van Cuong

scorbs.com/.../FinanceApplication.xbap

This above web does not need to install certification into browser. Can Anybody explain it to me. and How to do to have an application like that.

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Wednesday, April 15, 2009 5:31 AM by Dao Van Cuong

Do you have any solution automatically install certificate without using prerequisite. I want this solution is automatically not manually clicking to download prerequisite and then install it.

Can you help me?

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Thursday, April 16, 2009 11:00 AM by Maxim

Dao Van Cuong,

The [scorbs.com/.../FinanceApplication.xbap] doesn't require any certificate, because it doesn't access to any protected resources as "Client File System" or any other resource beyond the sandbox. This post explains about certificates for applications that run out of sandbox. As for application that you mean you just build it in as WPF-XBAP project and install on web server.

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Thursday, April 16, 2009 11:07 AM by Maxim

Dao Van Cuong,

There is no solution for automatic installer. The user can't run "EXE" application or any other script that access "Certificate Store" of the browser/OS, he must initiate/accept some action from web site that will suggest him to install certificate. So, if you build some XBAP application that requires certificate setup, provide some link to download the "Installer" for your certificate, user will run it and then will be able to use your XBAP.

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Friday, April 17, 2009 9:09 AM by Farhan

I'm able to run the application on client's browser iff client register the certificate. Isn't there any other way to avoid such thing? It looks quite awkward if every user going to register the certificate.

I also feel that I shouldn't make my application as XBAP, try to do same thing using asp 3.5

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Friday, July 24, 2009 9:44 AM by Vinay

Hi,

This is very good artical. It really helped me. I am successfully able to install certificate on IE. But I am not able to install on FireFox. Can anybody help me out?

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Thursday, August 06, 2009 12:00 PM by Maxim

Vinay,

Try this in FF:

Tools [Menu] > Options [Sub Menu] > Advanced [Top Tab] > Encryption [Tab] > View Certificates [BTN] > Your certificates [Tab] > Import [BTN] > Select Certificate File and Import.

Hope this was helpful.

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Wednesday, October 21, 2009 1:45 PM by sunny9988

Hi Wirat I have followed all ur steps carefully. When I go to Publish option of my application In prerequisites I do not get any windowinstallercertificate option . Whats wrong????????

# WPF XBAP: Import your Contacts from Outlook (demo)

Tuesday, November 10, 2009 9:34 PM by Chaves

&#160; [PT] (for a English version, see bellow on this page, please) Olá a todos, Recentemente num projecto

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Monday, December 28, 2009 10:37 AM by Ketki Thakor

I have followed your given steps.

The link(file:///C:/Inetpub/wwwroot/WpfApplication3/WpfApplication2.xbap) is working fine but (localhost/.../WpfApplication2.xbap) this link gives error trust not granted. I have IIS 5. Any solution?

# re: How to run WPF-XBAP Application in Full-Trust Mode (Post #2: certificate extraction)

Friday, June 04, 2010 1:16 PM by Gayathri

Hi Wirat

I followed all the steps u mentioned,

but i received the problem while publishing.

It's says CGI time out..Server deleted the process.

I dont understad where i made mistake.

Leave a Comment

(required) 
(required) 
(optional)
(required) 

Enter the numbers above: