How to sign a UWP app for sideloading using Trusted Signing?

Kevin 36 Reputation points
2024-07-22T10:50:19.9866667+00:00

We need to sign a UWP app for sideloading. Previously we have used a local certificate on our build machine and the build property:

<PackageCertificateThumbprint>XXXX</PackageCertificateThumbprint>

(This is configured in the .appxmanifest file for our UWP application and is currently used during the msbuild step.)

However the approach with the Azure Devops Trusted Signing task seems to be to use the azure pipelines task after the build has finished.

The problem is that our build won't complete without already having the matching certificate installed.

Please can you let me know the approach for integrating a Trusted Signing certificate with our UWP app?

Azure Trusted Signing
Azure Trusted Signing
Trusted Signing is a Microsoft fully managed, end-to-end signing solution that simplifies the certificate signing process and helps partner developers more easily build and distribute applications.
109 questions
Accepted answer
  1. Marilee Turscak-MSFT 36,866 Reputation points Microsoft Employee
    2024-07-25T22:39:50.3833333+00:00

    Hi @Kevin

    Addressing your follow-up questions from the comments:

    1. Previously an index.html file was produced which manages the .appinstaller and other links (such as to the msixbundle directly). This index.html file also links to the .cer file, which is no longer present (as Trusted Signing happens in the pipeline after the AppPackages folder is created during the build).

    A: When signing msixbundle with Trusted Signing, there is no need to have an extra .cer file. Just make sure the Publisher value in the AppxManifest.xml matches with the Subject name in the certificate profile. 

    1. When installing the msixbundle, I can see that the certificate is valid, but expires after only a few days. Does this mean that we are required to update our sideloading app on our website every 1-2 days, to avoid a certificate expiry? I had hoped that once our msixbundle had been signed, it would remain valid?

    A: As long as you call the timestamping, the msixbundle will remain valid, and you can install it.

    Please refer to this link to set up the signing command with timestamping: https://video2.skills-academy.com/en-us/azure/trusted-signing/how-to-signing-integrations#use-signtool-to-sign-a-file

    If the information helped you, please Accept the answer. This will help us and improve searchability for others in the community who may be researching similar questions.

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.