Digital Signing and Security

You can digitally sign your application to assure end users that the code within your application has not been tampered with or altered since publication. When you digitally sign your application, end users are presented with a digital certificate when they download your product.

When you are building a release on a Windows 2000 machine, SP4 must be installed in order for you to digitally sign the application.

In the Digital Signature panel of the Release Wizard, you can activate digital signing, indicate the location of your software publishing credentials (.spc) and private key (.pvk) files, and specify the password. You can also specify this information if you click the Digitally Sign Setup link on the Build Installation page of the Project Assistant. As an alternative, you can use the iSign application (iSign.exe) to digitally sign a release of an InstallScript project after you have built it from the command line.

iSign Command-Line Application

This application uses Microsoft Authenticode technology to create digital signatures for your installation. In order to use this program, you need a digital ID from VeriSign.

When you use the iSign application, you can specify options that are not available in the release build, such as the cryptographic service provider.

Filename is the fully qualified file name of your built release's Data1.hdr file.

Following is a list of the options that you can use with iSign. Note that, unlike other command-line applications, the switch and the argument for the switch should be separated by a space; for example:

iSign.exe -spc "C:\Temp\MyFile.spc" -pvk "C:\Temp\MyFile.pvk" -p "Test" -cp "Microsoft Base Cryptographic Provider v1.0"

Options for iSign.exe
Option	Description
-spc	Fully qualified file name of the software publishing credentials (.spc) file.
-v	Fully qualified file name of the private key (.pvk) file.
-p	Password for private key file.
-cp	Cryptographic service provider name, for example, "Microsoft Enhanced Cryptographic Provider v1.0". If the -cp option is not used, iSign tries each of the following service providers to find one that works with the specified private key file: "Microsoft Base Cryptographic Provider v1.0" "Microsoft Enhanced Cryptographic Provider v1.0" "Microsoft Strong Cryptographic Provider" For a list of cryptographic service providers, see Cryptographic Provider Names in the Platform SDK documentation or at the MSDN Web site. "Microsoft Base Cryptographic Provider v1.0" (MS_DEF_PROV) is appropriate for older certificates; if you are using a recent certificate and iSign fails, try using the other two. Note that the "v1.0" portion is required, even though some SDK documentation does not list it.

If iSign.exe is unable to determine the file to sign, the .spc file, or the .pvk file from the specified command line, the application displays the options (help) screen.