This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 25%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGN%3C/text%3E%3C/svg%3E)
Hello.
We have a UWP published through the MS store using the Microsoft Partner Center.
For security reasons, we want to block uploads of any package, unless it was signed with a private key from a specific certificate.
From a small search and testing, it seems that a package can be successfully uploaded as long as it has the same publisher id and PFN associated with the store, even if the package was signed with different certificates.
Is there a way to make sure the public key and/or thumbprint of the certificate used to sign are also validated when uploading a package?
Thanks,
Gilad.
Hi @Gilad Noy ,
Welcome to Microsoft Q&A!
Could you please provide more information to help us further check the problem for you? What is your scenario and why would you want to do certificate authentication when uploading packages?
Thank you!
The scenario is that there is a certificate that only a specific PC has, which we build and sign our app package with in order to upload to the MS store.
At the moment, anyone can create a certificate to build and sign this app, and the signature doesn't seem to be verified when this package is uploaded.
We want to do the certificate authentication to prevent creation of a malicious package on a non-authorized PC.
It still requires a user with access to the Partner Center to upload this package, but we want to reduce the security risks.
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Hi @Gilad Noy ,
Welcome to Microsoft Q&A!
I understand your need is to prevent the creation of malicious software packages on unauthorized PCs. But currently there is no documented UWP API that can do what you want.
Thank you!
Thanks.
Just making sure we understand each other.
My intention is to prevent uploading of a malicious package to the Partner site if an account was infiltrated by an attacker by validating the signature of the package.
You're saying this cannot be achieved?
Yes, this cannot be achieved. I know you want to reduce the risk of being attacked and need additional protection or encryption, but there is currently no documented UWP API that can do what you want.