Azure Key Vault
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
1,342 questions
How to interact with Azure key vault to sign the ClickOnce manifest ?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(22.400000000000002, 3%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Shakti Singh Dulawat
55
Reputation points
Dear Team,
We have EV Code signing Certificate and it's an stored at Azure key vault and we are able to sign in .exe file(using AzureSignTool) but not with the manifest so kindly assist that how can we achieve it .
Earlier we have used Mage command to achieve it but it need either PFX or thumbprint of the certificate and we can not use PFX with EV code signing certificate so we have tried with thumbprint(using -CH command) but it's throwing an error that the certificate does not contain the private key as CSR is generated through Azure.
certificate will be expire by tomorrow so your prompt response would be highly appreciated.
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 81%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMT%3C/text%3E%3C/svg%3E)
Marilee Turscak-MSFT 37,046 Reputation points Microsoft Employee2023-07-28T23:53:13.83+00:00 Could you please share which command you used to sign the ClickOnce manifest?
-
Dmitry Grabarev 40 Reputation points2023-08-22T16:15:02.63+00:00 We have the same question. The new code signing certificates are provided only in hardware tokens or can be stored in Azure key vault. We have a lot of legacy net 4.8 desktop applications deployed by ClickOnce and they need to be signed. Existing signtool.exe and mage.exe don't have an option to use certificate from azure key vault.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(268.8, 38%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EIK%3C/text%3E%3C/svg%3E)
Igor Kondrasovas 15 Reputation points2024-01-06T21:37:48.41+00:00 In our scenario, we used the approach and code available in this article: https://www.davici.nl/blog/clickonce-signing-from-azure-devops-via-azure-key-vault
It seems the solution implemented does not support click-once files containing the .deploy file extension, since they would need to be renamed back and forth at a certain moment. But if you uncheck this option from your deployment configuration, then it works fine.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(150.4, 34%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJM%3C/text%3E%3C/svg%3E)
Jean Milne 0 Reputation points2024-12-09T08:43:54.4033333+00:00 Is there going to be an update to Mage to support Azure Key Vault? This thread was opened back in January and I can't see any response on here from Microsoft about whether or not the situation will be dealt with?
Sign in to comment
1 answer
Sort by: Most helpful
-
Deleted
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Comments have been turned off. Learn more