EV code signing certificate mismatch

[marek_malewicz]

Hello,

I have a "certificate mismatch" problem.

syscomp_subcomp_signature_mismatch2.png (190.69 KiB) Viewed 20415 times

Here is what we did to generate the installer executable:

0.) Add an MSI from another vendor as a chained prerequisite (Main Package) in the project requirements section.
This prerequisite-MSI is already signed by the external vendor.

1.) Build the installer package as EXE.
(We tried to use the Digital Signature functionality provided by AdvInst but apparently Certum does not support automated EV Code Signing.)

2.) Sign the EXE installer package with an EV Code Signing Certificate from Certum using the signtool from Microsoft.



So I would like to ask you, if there is a way to configure an AdvInst project with an msi-prerequisite (Main Package) that has a different certificate than the one I'm using for the main project?

Best Regards,
Marek

[Catalin]

Hello Marek and welcome to our forums,

This error does not usually stem from your prerequisite certificate, but rather from a mismatch between the EXE bootstrapper and the MSI that is inside that bootstrapper.

2.) Sign the EXE installer package with an EV Code Signing Certificate from Certum using the signtool from Microsoft.

Most likely, the issue is coming from this. If you signed the EXE outside of Advanced Installer, then this behavior is normal, because the MSI inside the bootstrapper EXE is not signed.

(We tried to use the Digital Signature functionality provided by AdvInst but apparently Certum does not support automated EV Code Signing.)

You can not use the certificate together with our support? We use signtool.exe for signing, which is the go-to tool from Microsooft for signing purproses.

Best regards,
Catalin

[marek_malewicz]

Hello Catalin,

You can not use the certificate together with our support? We use signtool.exe for signing, which is the go-to tool from Microsooft for signing purproses.

We are using the signtool.exe for signing. Our problem is, that the Code Signing Dongle is currently bound to a different machine than where we keep the Advanced Installer (and we have no way to connect them). We are working on this problem.

This error does not usually stem from your prerequisite certificate, but rather from a mismatch between the EXE bootstrapper and the MSI that is inside that bootstrapper.
Most likely, the issue is coming from this. If you signed the EXE outside of Advanced Installer, then this behavior is normal, because the MSI inside the bootstrapper EXE is not signed.

This sounds great. Adjusting the bootstrapper EXE / .aip configuration is something that we can do w/o having to contact/ ask the external vendor to adjust their code signing.

Many thanks for the explanation,
Marek

[Catalin]

Hello Marek,

You are always welcome!

This sounds great. Adjusting the bootstrapper EXE / .aip configuration is something that we can do w/o having to contact/ ask the external vendor to adjust their code signing.

Yes, this is why we offer support for digitally signing your setup, so that both MSI and the EXE bootstrapper are signed with the same certificate.

If you manage to connect the two machines, then the signing of the EXE bootstrapper and the MSI inside should get rid of the error.

Best regards,
Catalin