I am attempting to set up an application for deployment via ClickOnce from a website, and apparently am unable to get ClickOnce to correctly sign the manifests.

I obtained a certificate through Thawte. To verify everything was okay with the .pfx file, I created a simple executable, used SignTool with the /f switch to specify the .pfx file to sign it, and then ran it from the web in a test environment. The dialog box asking whether I wanted to run it or not was able to correctly identify my company as the publisher, and in the certificate details dialog, under certification path, it correctly displayed:

Thawte Premium Server CA
Thawte Code Signing CA
My Company LLC

I then created a test application to deploy using ClickOnce, checked 'sign the ClickOnce manifests' on the signing tab in project properties, clicked the 'select from file' button, and chose the same file as used in the previous test. I then published the application and attempted to install it using the same test machine as the previous step. This time, the dialog box asking me whether I wanted to run it or not also seemed to correctly identify my company as the publisher, but when I clicked the hotlink on my company's name, the certificate dialog said "Windows does not have enough information to verify this certificate." On the certification path tab, the two entries for Thawte were missing, and it only showed my company's name with a yellow warning triangle.

I tried repeating the deployment process manually using the instructions for mageui and the walkthrough, and had the same result -- the certificate which worked fine in the first test case seems to be unable to chain back to the root authority when used with ClickOnce.

Has anyone seen anything like this or have any ideas for workarounds/fixes?

Yes, I was wrong about it just being a bug in the dialog. It's a complete muck-up that you have to work around.I posted back the information to your thread in the VSTO forum which is here:

http://social.msdn.microsoft.com/Forums/en-US/vsto/thread/44841131-58e7-4b8a-add2-a9cff869b82e

Someone posted something to that same thread about inclusion lists. I haven't tried that. I wonder if you can take that small console application and deploy it as a prerequisite to the VSTO Add-In installation. If you do try that, let me know if it works. I'd go muck around with it, but I don't expect to have time before 2nd week of October. If I do manage to carve out a slice of time to try it, I'll let you know.

RobinDotNet