Signing Tab for a Release

The Signing tab is where you specify the digital signature information—including the digital signature files granted to you by a certification authority—that InstallShield should use to sign your files. It is also where you specify which files in your installation should be digitally signed at build time.

Settings on the Signing Tab
Setting	Project Type	Description
Certificate URL	Basic MSI, InstallScript, InstallScript MSI, InstallScript Object, Merge Module, Web	Type a fully qualified URL—for example, http://www.mydomain.com. This URL is used in your digital certificate to link to a location you would like end users to visit in order to learn more about your product, organization, or company.
Digital certificate file (SPC or PFX)	Basic MSI, InstallScript, InstallScript MSI, InstallScript Object, Merge Module, Web	Specify the location of your digital certificate file (.spc or .pfx) provided by a certification authority. You can type the path to the file or use the Browse button to navigate to the file location. If you specify an .spc file, you must also specify a .pvk file.
Private key file (PVK)	Basic MSI, InstallScript, InstallScript MSI, InstallScript Object, Merge Module, Web	If you are using an .spc file, you must also specify the location of your private key file (.pvk) provided by a certification authority. You can type the path to the file or use the Browse button to navigate to the file location.
Certificate password	Basic MSI, InstallScript, InstallScript MSI, InstallScript Object, Merge Module, Web	If you would like to pass the password for the .pvk file or the .pfx file to ISCmdBld.exe to digitally sign your application while building the release from the command line, type the password in this box. InstallShield encrypts this password and stores it in your project (.ism) file. If you do not specify a password in this box but you are digitally signing the release while building it from the command line, you will need to manually enter the password when you are prompted each time that you build the release from the command line.
Sign Windows Installer Package	Basic MSI, InstallScript MSI, Merge Module, Web	If you want to sign your Windows Installer package (.msi file or .msm file), select this check box. This check box is enabled only if .spc and .pvk files are specified, or if a .pfx file is specified. You can sign the Windows Installer package only if version 2.0 or later is selected for the MSI Engine Version setting on the Setup.exe tab.
Sign media header (requires .spc and .pvk)	InstallScript	If you want to digitally sign the media header file (Data1.hdr), select this check box. This check box is enabled only if .spc and .pvk files are specified. InstallShield does not support using .pfx files to sign media header files (.hdr files), which are used for the One-Click Install type of installation for InstallScript projects. For this type of installation, consider one of the following alternatives: Use .spc and .pvk files instead of a .pfx file for your digital signature. Build a compressed installation, which would enable you to sign with a .pfx file.
Sign setup.exe	Basic MSI, InstallScript, InstallScript MSI, Web	If you want to sign your Setup.exe file, select this check box. This check box is enabled only if .spc and .pvk files are specified, or if a .pfx file is specified. In addition, this setting is applicable only to releases that meet the following criteria: Single-file Setup.exe Compressed files Network image media type
Sign files in package	Basic MSI, InstallScript, InstallScript MSI, InstallScript Object, Merge Module, Web	If you want to sign any of the files in your release, select this check box and then use the Include patterns and files and Exclude patterns and files boxes to indicate which files should be signed. All executable files (including .exe, .dll, .ocx, .sys, .cpl, .drv, and .scr files) in an installation must be digitally signed for the Certified for Windows Vista program.
Include patterns and files	Basic MSI, InstallScript, InstallScript MSI, InstallScript Object, Merge Module, Web	Specify the files and file patterns that you want to be digitally signed at build time. Note the following guidelines: You can type directly in the box. As an alternative, you can click the Files button, which launches the Browse for file dialog box. This dialog box lists all of the static files that are currently in your project. It also lists file patterns such as .dll, which you can select. To indicate a wild-card character, use an asterisk (). For example, if you want to sign all .exe files, specify the following: .exe Using wild-card characters is especially helpful if you include dynamically linked files in your project and you want to sign all files that match a certain pattern. Put each file and each file pattern on its own line, with each separated by a carriage return. Note that the files and file patterns that should not be signed override any files and file patterns that should be signed. For example, if you specify .exe in the Include patterns and files box and in the Exclude patterns and files box, InstallShield does not sign any .exe files.
Exclude patterns and files	Basic MSI, InstallScript, InstallScript MSI, InstallScript Object, Merge Module, Web	Specify any files and file patterns that you do not want to be digitally signed at build time. Note the following guidelines: You can type directly in the box. As an alternative, you can click the Files button, which launches the Browse for file dialog box. This dialog box lists all of the static files that are currently in your project. It also lists file patterns such as .dll, which you can select. To indicate a wild-card character, use an asterisk (). For example, if you do not want to sign any .drv files, specify the following: .drv Using wild-card characters is especially helpful if you include dynamically linked files in your project and you want to avoid signing any files that match a certain pattern. Put each file and each file pattern on its own line, with each separated by a carriage return. Note that the files and file patterns that should not be signed override any files and file patterns that should be signed. For example, if you specify .exe in the Include patterns and files box and in the Exclude patterns and files box, InstallShield does not sign any .exe files.
Sign files that are already signed	Basic MSI, InstallScript, InstallScript MSI, InstallScript Object, Merge Module, Web	If any of the files in your project are already digitally signed, determine whether you want InstallShield to replace those existing digital signatures with the digital signature that you specify on the Signing tab. Note that this affects only files that meet the requirements that are specified in the Include patterns and files and Exclude patterns and files boxes. To use the digital signature information that you are providing on the Signing tab to sign a file instead of any existing digital signature information that is already included with the file, select this check box. To leave the existing digital signature information intact for any files that are already signed, clear this check box. This check box is cleared by default.
Sign files in their original location	Basic MSI, InstallScript, InstallScript MSI, InstallScript Object, Merge Module, Web	Determine whether you want InstallShield to sign your original files or just the files that are built into the release: If you want InstallShield to sign a temporary copy of each file and then use that signed temporary copy to build a release, clear this check box. Note that if you clear this check box, InstallShield will not modify or sign your original files. If you want InstallShield to sign your original files, select this check box. This check box is cleared by default. The benefit of selecting this check box for a Basic MSI or InstallScript MSI project is that it helps create one patch that updates both compressed and uncompressed versions of a release that contains originally unsigned files.