1. ClickOnce Application,Expired Certificates & Public Key Token PART I
2. ClickOnce Application,Expired Certificates & Public Key Token PART II

During my work on this ClickOnce update, we decided to upgrade the application to target .net framework 3.5 sp1.

so I just set the target framework to 3.5 and set the required prerequisites (.net 3.5 SP1, and Windows Installer 3.1). and built the project and published it. and when I tried on a client machine which had .net framework 2.0, application got updated, prompted the uninstall message, and tried to launch the new ClickOnce application from the new URL, and BANG!. we get an error :

The Error Message Says :

Unable to install or run the application. The application

requires that assembly WindowsBase Version 3.0.0.0 be

installed in the Global Assembly Cache (GAC) first.

Why is this ?, its because when we try to launch the new application URL we do this :

DeploymentUtils.AutoInstall("<Path toNewApplication.application>");

we request for the application manifest. and it fails to launch the application because it doesn’t have the prerequisites. and now to force the new prerequisites the application should call the setup.exe in the Web Server instead of the manifest. now the question is, what if the user already have  the .net Framework 3.5 SP1?, we don’t have to prompt the client to install them again by launching setup.exe, we just have to launch the manifest. To Serve both the above scenario we need to check if the client machine has .net framework 3.5 SP1, and depending on its availability we need to launch the manifest or the setup.exe. The existence of .net Framework can be obtained from the following registry location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP you can find out all the .net Frameworks installed and their service pack versions in this registry entry. Following are the locations of the main Net Frameworks:

Now we can check if the required .net Framework is available in the client machine, and launch the application setup.exe or the manifest. to do this we need to programmatically check these registries. for this I used the attached code ( I Couldn’t find the original author, Credits goes to him/her) which I found from web and modified to avoid few bugs. you can add this code to your project and do the below check in your application to decide which file to be launched :

string FileToLaunch=@"/setup.exe";
if (FrameworkUtils.IsInstalled(FrameworkVersion.Fx35)

 && FrameworkUtils.GetServicePackLevel(FrameworkVersion.Fx35) == 1)
          {
            FileToLaunch = @"/<application manifest.application>";
          }
            MessageBox.Show("Your message here");
            string updateURL = DeploymentUtils.getUpdateURL();
            DeploymentUtils.UninstallMe();
            DeploymentUtils.AutoInstall("https://" + updateURL + FileToLaunch);
            Application.Exit();

And that’s all, now the application will launch the setup.exe if the client doesn’t have the .net Framework 3.5 and prompt for its installation, or launch the application manifest if client has the framework installed.

Now you can solve your ClickOnce issue as well as upgrade .net Framework in client machine at the same time without problem.

Download FrameworkUtils.cs

• ClickOnce Application,Expired Certificates & Public Key Token PART I
This post is not going to be a long one, I  just want to point out a very important issue, when updating the ClickOnce using the method specified in PART I .
When using Jim Harte’s Method to update a ClickOnce with a new certificate, it checks for the public token key of the current application to find its uninstall string, and then execute runDLL32 to trigger the uninstall. below is the code which gets the uninstall string:

/// <summary>
/// Gets the uninstall string for the current ClickOnce app from the Windows 
/// Registry.
/// </summary>
/// <param name="PublicKeyToken">The public key token of the app.</param>
/// <returns>The command line to execute that will uninstall the app.</returns>
 private static string GetUninstallString(string PublicKeyToken,

                          out string DisplayName)
{
 string uninstallString = null;
 string searchString = "PublicKeyToken=" + PublicKeyToken;
 RegistryKey uninstallKey = _
      Registry.CurrentUser.OpenSubKey

                ("Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall");
 string[] appKeyNames = uninstallKey.GetSubKeyNames();
 DisplayName = null;
 foreach(string appKeyName in appKeyNames)
{
  RegistryKey appKey = uninstallKey.OpenSubKey(appKeyName);
  uninstallString = (string)appKey.GetValue("UninstallString");
  DisplayName = (string)appKey.GetValue("DisplayName");
  appKey.Close();

 if(uninstallString.Contains(searchString))
                    break;
 }
            uninstallKey.Close();
            return uninstallString;
        }

 

In the above code it goes through registry keys of all ClickOnce application to get the uninstall string. and if that uninstall string contains the Public Token key of the current application, it will uninstall the application with that particular uninstall string. this is completely ok if there is only one application with that public token key. the public key of an assembly name identifies the developer (or the organization). Most organizations use only one public key to sign their assemblies with. so what if there is more than 1 application which has the same public token key?

1. The code will uninstall the very first match in the above code and it might uninstall some other application, instead of uninstalling the one we need to uninstall.
2. and it will  also install the new application from new URL, but with a different name sometimes (Eg: application name -1).
3. And if it had uninstalled another application, whenever user launches this application it will prompt the uninstall screen, each time when there are more than 1 application with the same public token key.

The Image below shows an uninstall string, which contains the application name, and public token key:

To avoid this problem of wrong application getting uninstalled, I changed this part of the code from above code to :

if(uninstallString.Contains(searchString)) break; 

this:

if(uninstallString.Contains(searchString)
               && uninstallString.Contains("yourApp.application"))
                    break;

 

In the code above, I’m Checking the ClickOnce application name with extension, along with the public token key to find out the correct uninstall string. that’s it!.

Hope this solves your time in someway.

Problem description

ClickOnce allows application updates, only if the updated application manifests are signed with the same certificate (publisher) as was used to originally sign the application manifests. However, most CA’s like Verisign, and many enterprise customers own CA’s generate new certificates with new key pairs and only the same common name (CN).

The certificate is used for the Authenticode signature element and for the strong name signature element of the manifest file to protect it against tampering, and to provide identity information for the trust manager. If the signing certificate expires and you publish an application update with a renewed certificate which has different keys, then the update will fail with the error message described in the KB article.

There are lots of issues, and threads are being discussed how to resolve this issue. and these are the preferable solutions available on net.

1. Manually Uninstall and Re install the application with new certificate – which we cannot do when we have a large number of client base who are using our ClickOnce Applicaiton.
2. Install .net Framework 2.0 SP1 for XP /  .Net Framework 3.5 SP1 for vista or later, in these service pack s for .net Framework, this bug is fixed, and it will seamlessly update the application. – but we cannot force or inform clients to do that. yeah by this time most of the users might have installed .net framework 3.5 sp1 through windows automatic updates. but even if one guy haven’t done that KABOOM!!, clients are going to complain.
3. Sign the new click once with 2 different keys – a solution by Daniel Margetic , even though developers may like it, when considering Automation, and  Infrastructure of build servers this might not be a favorite solution.
4. Automatically Uninstalling the old application, and re-install the new application. – a solution by Jim Harte , using this method, we will be releasing an update for the application with expired certificate, which will have scripts for automatically uninstall the applicaiton, and install the application with new certificate, from a new location. the following thread on MSDN explains this process completely:
             VS2008 SP-1 change certificate, user can’t pick up update

   The last one seems to be a favorite of most of the people around the globe. it uses these classes by  Jim Harte  to uninstall and re install the application, using the following code:

MessageBox.Show("Your Message to Client");
DeploymentUtils.UninstallMe()
DeploymentUtils.AutoInstall("<Path toNewApplication.application>");
Application.Exit();

you can have the new path as a sub folder of current applications update URL. you can get a ClickOnce applicaitons update URL using the line below :

ApplicationDeployment.CurrentDeployment.UpdateLocation.Host

That would do the trick. so what is it about Public Token Key ??. I will explain this in the PART 2 of this article.

Hope it helps,

Aneef

I just posted the Part II of this series is here.

Special Note:

Thanks to RobinDotNet for his wonderful support through MSDN and through his blog to solve this problem.