Digitally sign a Visual Studio 2012 VSIX extension

问题

I am trying to sign a Visual Studio 2012 extension that is packaged as a VSIX file.

I have followed the instructions at http://www.jeff.wilcox.name/2010/03/vsixcodesigning/; however, I am interested in performing signing without specifying a pfx file and password.

For example, if I were to call 'signtool.exe', my command line would be:

"signtool.exe" sign /n MySubjectName /t 'http://timestamp.verisign.com/scripts/timstamp.dll' /d "MyDescription" MyPackage.vsix

I understand that this command does not work with VSIX files, though it does work for an MSI archive.

With this command, I do not need to specify a password or pfx file when calling signtool. The best installed certificate is selected, using the specified subject MySubjectName.

Following the code on Jeff's Blog, the signing step requires pfx file name and password to be defined to create the X509Certificate2 used in signing:

 private static void SignAllParts(Package package, string pfx, string password, string timestamp){
  var signatureManager = new PackageDigitalSignatureManager(package);
  signatureManager.CertificateOption = CertificateEmbeddingOption.InSignaturePart;

  /*...*/

  signatureManager.Sign(toSign, new System.Security.Cryptography.X509Certificates.X509Certificate2(pfx, password));
}

Is there any API involving PackageDigitalSignatureManager that might let me find a X509Certificate based on MySubjectName so that I can sign against that?

回答1:

I've solved this by iterating over the certificates found in the current user's store. I filter by the issuer name and take only valid certificates, then I loop over the matching certificates and return the first one which matches also the subject name:

public static X509Certificate2 Find(string issuer, string subject)
{
    var certStore = new X509Store (StoreName.My, StoreLocation.CurrentUser);
    certStore.Open (OpenFlags.ReadOnly);
    var certCollection = certStore.Certificates.Find (X509FindType.FindByIssuerName, issuer, true);

    foreach (var cert in certCollection)
    {
        if (cert.FriendlyName == subject)
        {
            return cert;
        }
    }

    return null;
}

来源：https://stackoverflow.com/questions/13370533/digitally-sign-a-visual-studio-2012-vsix-extension