nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Add-In code signing and timestamps

JeffreyHamblin

I have used 1-year term code signing certificates for several years. Typically, when I sign software (not Add-Ins) using Microsoft's signtool.exe utility, I specify a timestamp server. Timestamping ensures that the signed file will not expire when the certificate expires. Without using the timestamping option during the signing process, the signed file would expire and have to be re-signed with a new cert each year.

My question is whether the ESRISignAddIn.exe utility does any sort of timestamping, or uses some other method, so that signed Add-Ins do not expire annually.

-Jeff

Find more posts tagged with

Accepted answers

All comments

DiegoLlamasOlivares

diegollamas:

On a 32-bit PC with a default ArcGIS for Desktop installation and the SDK for .NET installed, the ESRISignAddIn.exe utility can be found at C:\Program Files\Common Files\ArcGIS\bin.

I am not sure if the SDK is required or not, but if you can't find the utility, it may be the reason.

jeffhamblin has posted the location of this utility on 64-bit PCs in this thread as well.

Good luck,
Dennis

Thanks Dennis I found it

MeToo

diegollamas:

On a 32-bit PC with a default ArcGIS for Desktop installation and the SDK for .NET installed, the ESRISignAddIn.exe utility can be found at C:\Program Files\Common Files\ArcGIS\bin.

I am not sure if the SDK is required or not, but if you can't find the utility, it may be the reason.

jeffhamblin has posted the location of this utility on 64-bit PCs in this thread as well.

Good luck,
Dennis

DiegoLlamasOlivares

Hi

Where can I download the ESRISignAddIn.exe file, I cant find it anywhere!

Thanks

JeffreyHamblin

Hi Dennis,

The current version of the ESRI Digital Signature Wizard (as of 10.0 SP2) does not implement the use of a timestamping server to write a signed timestamp into the signature, nor does the code in ArcGIS that validates Add-Ins look for one and handle it. Both only use the simple signing date of the signing machine. So all you specify on the wizard is the file to be signed and the certificate with which to sign it.

As of 10.0 SP2, a signature is validated by ArcGIS as Authenticated if the Add-In was signed on a date before the code-signing cert expired. However it will still be noted as an expired cert in the Add-In Installer after the cert's expiration date.

It would be more secure to implement true timestamping via server, and more compliant with typical code-signing practice to not display signatures as expired that include a valid timestamp signature.

MeToo

Hi Jeff & Xiaoling:

I am brand new to code signing.

Where do you specify the timestamping server when using the ESRISignAddIn.exe utility?

Thanks,
Dennis

JeffreyHamblin

Hi Steve,

Thanks for the workaround. It works 🙂

Just a note for anyone else wanting to use the workaround:

Move the ESRISignAddIn.exe file
From: \Program Files\Common Files\ArcGIS\bin
To: \Program Files\ArcGIS\Desktop10.0\Bin

(on 64-bit systems that will be \Program Files (x86)\ )

-Jeff

vanesch

Thanks for reporting this Jeff, this is indeed a problem with 10.0 Service Pack 1. Service pack 1 didn't install the correct version of a file that affects only resigining. As a workaround, can you move ESRISignAddIn.exe to your ArcGIS/bin directory, it should work fine there? We'll get this addressed in service pack 2.

Thanks again,
Steve

JeffreyHamblin

Hi Jeff,
Thank you for your feedback. We have fixed this issue by validating add-in's digital signature using time stamp and the fix will be in the coming ArcGIS 10.0 SP2.
You also got a crash when re-running ESRISignAddIn.exe on a previously signed add-in. We'd like to know your steps since we couldn't reproduce this issue.

Thanks!
Xiaoling

Thank you for the good news, Xiaoling. I thought I would be lucky to see a resolution in 10.1, so getting it in SP2 is fantastic!

I have attached a screenshot and a text file with the steps to reproduce the SignAddIn utility crash.

-Jeff

SignAddIn_Crash_Dlg.png

SignAddIn_crash_info.TXT.zip

askForum-EnvSampLocation-3.jpg

error.jpg

XiaolingYang

Hi Jeff,
Thank you for your feedback. We have fixed this issue by validating add-in's digital signature using time stamp and the fix will be in the coming ArcGIS 10.0 SP2.
You also got a crash when re-running ESRISignAddIn.exe on a previously signed add-in. We'd like to know your steps since we couldn't reproduce this issue.

Thanks!
Xiaoling

JeffreyHamblin

Just an update for anyone following this thread:

I submitted a report to ESRI technical support. I will report back here any replies.

-Jeff

JeffreyHamblin

I just found out the answer, because my 1-year code signing certifcate expired a few days ago.

The ESRISignAddIn.exe utility DOES NOT timestamp the digital signature, and therefore once valid dates for the signing cert are exceeded, Add-ins will, at best, show an expired and untrusted digital signature; and worse, if the security setting for Add-ins is set to "Require Add-Ins to be digitally signed by a trusted publisher" -- the Add-In will no longer be loaded.

Frankly, this behavior will lead to a deployment nightmare. Having software fail in the field just because the original signing cert expires is not typical. And neither is having to re-sign ALL previously completed, signed and released software.

I am hoping ESRI can comment, and possibly provide a work around.

Additionally, I just noticed that one can't simply re-run the ESRISignAddIn.exe utility on an Add-In that was previously signed, to re-sign it with a new certificate -- doing that crashes the utility. It must be run on an un-signed version of the Add-In.

-Jeff

Join the Conversation

Signed in members can post, follow updates, and more. New here? Register a free account.

Quick Links

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.