Hi,
I have a VSTO 2010 Excel add-in, targeting .Net Framework 4.0, Visual Studio 2010.
We were using a SHA-1 certificate for the past few years for signing the manifest and the assemblies. The application has been deployed for a lot of end-users. Now with the SHA-1 deprecation policy coming into effect from January 2016, the renewed certificate
that has been issued by the CA is keyed using SHA-256.
In Visual Studio 2010, when I update the certificate and try to rebuild the project, contents of the generated .VSTO file looks like this:
<assemblyIdentity name="ExcelAddIn1.vsto" version="1.0.0.1" publicKeyToken="2142698160a31911" language="neutral" processorArchitecture="msil" xmlns="urn:schemas-microsoft-com:asm.v1" /><description asmv2:publisher="My Company" asmv2:product="ExcelAddIn1" xmlns="urn:schemas-microsoft-com:asm.v1" /><deployment install="false" /><compatibleFrameworks xmlns="urn:schemas-microsoft-com:clickonce.v2"><framework targetVersion="4.0" profile="Client" supportedRuntime="4.0.30319" /><framework targetVersion="4.0" profile="Full" supportedRuntime="4.0.30319" /></compatibleFrameworks><dependency><dependentAssembly dependencyType="install" codebase="ExcelAddIn1.dll.manifest" size="18274"><assemblyIdentity name="ExcelAddIn1.dll" version="1.0.0.1" publicKeyToken="2142698160a31911" language="neutral" processorArchitecture="msil" type="win32" /><hash><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity" /></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><dsig:DigestValue>DIGEST VALUE</dsig:DigestValue></hash></dependentAssembly></dependency><publisherIdentity name="CN=, OU=, O=My Company, L=, S=, C=" issuerKeyHash="ISSUER HASH" /><Signature Id="StrongNameSignature" xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha256" /><Reference URI=""><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha256" /><DigestValue>DIGEST VALUE</DigestValue>
Note that the DigestMethod for dependentAssembly is SHA1, where as the DigestMethod for publisherIdentity is SHA256. ExcelAddin1.dll.manifest also follows this pattern.
On rebuilding the project in Visual Studio 2015, still targeting .NET framework 4.0, SHA1 is used as the DigestMethod everywhere in the .VSTO and .MANIFEST files.
On updating the project to target .Net Framework 4.5.2 and building it, SHA256 is used throughout these files.
I am able to work with both these build on a machine having Windows 7 SP1, Excel 2010 SP1, .Net Framework 4.5.2 and VSTO 4 Runtime 10.0.60724
Q1. How does the SHA-1 deprecation policy affect VSTO add-ins?
Q2. Can I continue to use SHA-1 certificates for VSTO add-ins even after January 2016?
Q3. Do I have to upgrade the .Net Framework version to be fully compliant about SHA-2 signing?
Q4. What should be the timestamp URL while using SHA-2 certificates? mage.exe shipped with SDK for .NET 4.0 does not have an option to specify the DigestAlgorithm and , however mage.exe that come along SDK for .Net Framework 4.5.2 does have this option -Algorithm<sha256RSA|sha1RSA> -a.
Thank you.
Regards,
CS