Creating Signed CAB Files for MFC and ATL Controls

[This documentation is for preview only, and is subject to change in later releases. Blank topics are included as placeholders.]

If you plan to distribute MFC and ATL controls via the Internet, you should package them as signed Cabinet (CAB) files. Signed files help assure a user downloading your control that the code is safe. A CAB file contains a compressed version of your control plus information about how your control is to be installed, for example, which DLLs need to be installed along with the OCX.

The following is information you will need for creating signed CAB files for ActiveX controls:

  • Installing the Windows SDK**.** You can install the tools you need to create and sign CAB files from the Windows SDK. For download information, see "Microsoft® Windows® Software Development Kit for Windows Vista™ and .NET Framework 3.0 Runtime Components" at the MSDN Library.

    During installation, choose to install "Internet Explorer Tools." Both the code signing files and the CAB utilities can be found in the installed Mssdk\Bin directory. (Note that "Mssdk" might be named "Microsoft Windows SDK" by some installations.)

  • Authenticode technology and CryptoAPI Tools. You can find information on signing code with Microsoft Authenticode technology in CryptoAPI Tools Reference, located in the Windows SDK documentation (in MSDN Library/Security/Cryptography).

  • Microsoft Security Advisor site. See

Before you can sign files, you need to get a Software Publisher Certificate. You must apply for your own certificate to a Certification Authority. With the tools in the Mssdk\Bin directory you can create a test certificate for testing purposes, but this certificate cannot be used to sign code for distribution. See step 1 for information about applying for a Software Publisher Certificate.

These are the steps to create a signed CAB file:

  1. Get a Software Publisher Certificate (you only need to do this once).

  2. Create the CAB file.

  3. Sign your files.

  4. Embed the signed CAB file in a Web page (optional).

See Also


MFC Internet Programming Tasks