You have to have the users install the prerequisite. (Over a year later, I know much, much more about ClickOnce deployment!).
I created a solution to handle the case of the expiring certificate, where you have your ClickOnce application uninstall itself and then install a new version. When installing the new version, you can call the setup.exe which will install the prerequisites.
We are going to upgrade to .Net 3.5 later this summer, and when we do that, we will use this same method -- have the application programmatically uninstall itself and then install the new one, invoking the setup.exe (from a differnet url) with the prerequisites set to .Net 3.5.
Here's a blog article about it that gives all the code:
http://robindotnet.wordpress.com/2009/03/30/clickonce-and-expiring-certificates/If you are in a corporate environment, you can get .Net 3.5 pushed to your users' machines, and then just change the prerequisite and redeploy an update and it will work. We don't have that luxury, and don't know if all of our users have .Net 3.5 installed.
Another thing to note (another blog posting on the robindotnet.wordpress.com blog) is that Microsoft is now pushing .Net 3.5 SP-1 to any machine with any version of .Net on it as an automatic update.
RobinDotNet
(RobinS., GoldMail.com)
Click here to visit my ClickOnce blog!