"Patching secure assemblies whose digital certificate has expired" ??

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

"We use an Authenticode (digital code signing) certificate from Verisign to
digitally sign our .NET assemblies, and to ensure the assemblies in a
calling tree are authentic as each class and public method in secure
assemblies are decorated with this attribute:



[System.Security.Permissions.PublisherIdentityPermission(SecurityAction.LinkDemand,

X509Certificate=CodeIdentity.PublisherX509Certificate)]



which has the effect of ensuring that the set of secure assemblies have all
been signed with our Authenticode certificate and are therefore authentic.
The issue that we have is that once such a set of secure assemblies has been
deployed to our customers, and the Authenticode certificate used to sign
them has expired, is it possible to create a "patch" (a small subset of
updated/fixed assemblies) that will work with this old set of secure
assemblies, or must we (at a minimum) re-sign all these assemblies with a
new, valid Authenticode certificate and redeploy the whole set along with
the few that are being updated?



If it is not possible to perform such a "patch", is Microsoft considering a
way to securely support such an action? It seems that many .NET clients in
addition to our company would have a need to do this."

-jeff arnett


.

Relevant Pages

  • "Patching secure assemblies whose digital certificate has expired" ??
    ... which has the effect of ensuring that the set of secure assemblies have all ... been signed with our Authenticode certificate and are therefore authentic. ...
    (microsoft.public.dotnet.general)
  • Re: Signing code programatically
    ... Niclas, ... When you sign a PE file (including .NET managed assemblies) the ... Authenticode signature is added the same way to the PE whether it is ...
    (microsoft.public.dotnet.security)
  • Re: Authenticode signing an assembly
    ... Authenticode signatures are applied to assemblies exactly the ... the hash with the hackers own private key, ... Embed public part of certificate and encrypted hash in assembly. ...
    (microsoft.public.dotnet.security)
  • Re: Code signing (signcode versus strong name)?
    ... Authenticode and strong names provide two different ways to digitally sign ... Authenticode the implementation of publisher trust is ... Authenticode signatures and strong names were developed to solve separate ... assemblies. ...
    (microsoft.public.dotnet.security)
  • Re: Adjusting security setting to run an embedded windows control in IE
    ... Just so you remember that I said this is the less secure and thus less ... The other advantage is that you can easily deploy other assemblies with the ... >> How does one go about giving an AppDomain full trust by using a URL ... >> membership condition? ...
    (microsoft.public.dotnet.security)