Azure Key Vault
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
1,293 questions
How to interact with Azure key vault to sign the ClickOnce manifest ?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(22.400000000000002, 3%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Shakti Singh Dulawat
45
Reputation points
Dear Team,
We have EV Code signing Certificate and it's an stored at Azure key vault and we are able to sign in .exe file(using AzureSignTool) but not with the manifest so kindly assist that how can we achieve it .
Earlier we have used Mage command to achieve it but it need either PFX or thumbprint of the certificate and we can not use PFX with EV code signing certificate so we have tried with thumbprint(using -CH command) but it's throwing an error that the certificate does not contain the private key as CSR is generated through Azure.
certificate will be expire by tomorrow so your prompt response would be highly appreciated.
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 81%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMT%3C/text%3E%3C/svg%3E)
Marilee Turscak-MSFT 36,856 Reputation points Microsoft Employee2023-07-28T23:53:13.83+00:00 Could you please share which command you used to sign the ClickOnce manifest?
-
Dmitry Grabarev 40 Reputation points2023-08-22T16:15:02.63+00:00 We have the same question. The new code signing certificates are provided only in hardware tokens or can be stored in Azure key vault. We have a lot of legacy net 4.8 desktop applications deployed by ClickOnce and they need to be signed. Existing signtool.exe and mage.exe don't have an option to use certificate from azure key vault.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(268.8, 38%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EIK%3C/text%3E%3C/svg%3E)
Igor Kondrasovas 15 Reputation points2024-01-06T21:37:48.41+00:00 In our scenario, we used the approach and code available in this article: https://www.davici.nl/blog/clickonce-signing-from-azure-devops-via-azure-key-vault
It seems the solution implemented does not support click-once files containing the .deploy file extension, since they would need to be renamed back and forth at a certain moment. But if you uncheck this option from your deployment configuration, then it works fine.
Sign in to comment
Sign in to answer