ClickOnce signing: Is it possible only with SHA256 certificate?

Question

I want to sign a ClickOnce application but I cannot make it work, I always get a warning or an error that prevents installation.

I've read some old articles that said that I need both SHA-1 and SHA256 certificates in order to sign a ClickOnce application.
It worked fine for a long time but I cannot make it work any more.

1. SHA1 certificates are deprecated
   https://learn.microsoft.com/en-us/sysinternals/announce/sha1deprecation
2. It is difficult to get a SHA-1 from my EV Code Signing Certificate Provider

Is it possible to use ClickOnce nowadays or should I use another installer and rewrite my application?

Answer 1

You have posted in the windows 10 application compatibility forum, since your issue is related to “ClickOnce and Setup & Deployment Projects”. I suggest you ask at the dedicated windows forms forum over here:

https://learn.microsoft.com/en-us/answers/topics/windows-forms.html?page=1&pageSize=15&sort=active&filter=all

Best regards,
sylvia

Answer 2

Just to check if the above reply could be of help, if yes, you may mark useful reply as answer, if not, welcome to feedback.

Best regards,
Sylvia

Answer 3

The clickonce forum has been shut down. Users are told to post here.

Answer 4

Signtool no longer supports signing of ClickOnce manifests; use Mage instead. However, you may soon hit another problem -- you can't interact with Hardware Security Modules (HSMs) to sign ClickOnce manifests. (HSMs are typically your only option when dealing with EV certificates these days.)

Your best option is to migrate away from ClickOnce. (Sorry.)

Answer 5

@WithinRafael (HSMs) are not supported since .net 4.7 to sign clickonce manifest as documented here

I just bring back this thread as I had issue with a new certificate and investigating EV.