When signing .esriAddinX files using Azure Key Vault (/kvu and /kvc parameters), the resulting signature shows as Trusted but not Verified in the Esri ArcGIS Add-In Installation Utility. This only affects add-ins above a certain file size threshold (~700KB). Smaller add-ins sign and verify correctly. PFX-based signing (/c and /p parameters) works correctly for all file sizes. Steps to Reproduce: * Build an .esriAddinX add-in that is larger than ~700KB * Configure Azure Key Vault with an RSA-HSM 4096-bit code signing certificate * Authenticate via az login --service-principal and set AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET environment variables * Sign the add-in: ArcGISSignAddIn.exe MyAddin.esriAddinX /kvu:https://my-vault.vault.azure.net /kvc:my-certificate * The tool reports success * Open the signed .esriAddinX — the Add-In Installation Utility shows Verified ☐ (unchecked), Trusted ☑ (checked) Size-dependent behavior (tested with multiple add-ins): Size Key Vault Verified ~290 KB✓ Works~300 KB✓ Works~700 KB✓ Works~703 KB✗ Fails~1.1 MB✗ Fails~17 MB✗ Fails The failure threshold appears to be around 700KB. Workaround: Double-signing the add-in — first with Key Vault (for Trusted), then with a PFX certificate (for Verified) — results in two signature entries, and ArcGIS Pro accepts the add-in under the "Require Add-Ins to be digitally signed by a trusted publisher" security policy. Was anybody able to sign addins larger than the observed threshold?

nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

ArcGISSignAddIn.exe Key Vault signing produces unverified signatures for add-ins larger than ~700KB

marco_vertigis

When signing .esriAddinX files using Azure Key Vault (/kvu and /kvc parameters), the resulting signature shows as Trusted but not Verified in the Esri ArcGIS Add-In Installation Utility. This only affects add-ins above a certain file size threshold (~700KB). Smaller add-ins sign and verify correctly. PFX-based signing (/c and /p parameters) works correctly for all file sizes.

Steps to Reproduce:

Build an .esriAddinX add-in that is larger than ~700KB
Configure Azure Key Vault with an RSA-HSM 4096-bit code signing certificate
Authenticate via az login --service-principal and set AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET environment variables
Sign the add-in:
ArcGISSignAddIn.exe MyAddin.esriAddinX /kvu:https://my-vault.vault.azure.net /kvc:my-certificate
The tool reports success
Open the signed .esriAddinX — the Add-In Installation Utility shows Verified ☐ (unchecked), Trusted ☑ (checked)

Size-dependent behavior (tested with multiple add-ins):

Size Key Vault Verified

~290 KB	✓ Works
~300 KB	✓ Works
~700 KB	✓ Works
~703 KB	✗ Fails
~1.1 MB	✗ Fails
~17 MB	✗ Fails

The failure threshold appears to be around 700KB.

Workaround:
Double-signing the add-in — first with Key Vault (for Trusted), then with a PFX certificate (for Verified) — results in two signature entries, and ArcGIS Pro accepts the add-in under the "Require Add-Ins to be digitally signed by a trusted publisher" security policy.

Was anybody able to sign addins larger than the observed threshold?

Trouver plus de publications taguées avec

Accepted answers

UmaHarano

Hi @marco_vertigis

Thank you for reporting this issue. I can confirm that this issue has been fixed in ArcGIS Pro 3.7. This version will be available for release very shortly.

Thanks!
Uma

All comments

UmaHarano

Hi @marco_vertigis

Thank you for reporting this issue. I can confirm that this issue has been fixed in ArcGIS Pro 3.7. This version will be available for release very shortly.

Thanks!
Uma

marco_vertigis

Hi @UmaHarano

Thats good to hear! thanks for the fast response.

jmmGeo

We had also encountered this when trying to sign our add-in using the Pro SDK 3.6 signing tool. The other thing we noticed is that add-ins signed with the 3.6 signing tool using a cert from the Azure Key Vault resulted in a signature only being recognized in Pro 3.6 and not earlier versions. Internally, the structure of the .esriAddinX file was different with regards to the signature and the certificate. Is that your experience as well?

marco_vertigis

I only tested it for ArcGIS Pro 3.6.1. The doc mentions that the support for Azure Key Vault was introduced in Pro 3.6.x. So there is maybe no backwards compatibility.

Starting with ArcGIS Pro 3.6, the ArcGISSignAddin.exe tool supports signing addins from the command-line with a certificate stored in an Azure Vault.

Source: https://github.com/Esri/arcgis-pro-sdk/wiki/ProGuide-Digitally-signed-add-ins-and-configurations#code-signing-using-certificates-stored-in-an-azure-key-vault

Rejoindre la conversation

Les membres connectés peuvent publier, suivre les mises à jour, et plus encore. Nouveau ici ? Inscrivez-vous gratuitement.

Liens rapides

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.