Need help with ClickOnce deployment on .NET Framework 4.7.2 – "Unidentified program" warning and antivirus issues even with self-signed certificate

[gestorcampos]

Hello,

I have a WinForms application built on .NET Framework 4.7.2 that I'm publishing using ClickOnce from Visual Studio Community 2022 (official Microsoft version).

Even after signing the application with a valid SHA256 V3 self-signed certificate, when I publish and try to install it via ClickOnce, I receive a warning saying the program is unidentified.

Additionally, when I try to install the application on a machine that has antivirus software, the antivirus flags the program precisely because of the missing/certificate validation issue.

How should I proceed? I'd like to know the correct way to publish with ClickOnce so that the application is fully recognized as valid by Windows, since I'm running into these antivirus validation problems.

Thanks in advance for any guidance!

[tbolon]

You question is not specific about winforms but windows application in general.

Self-signed certificates are not considered trusted (obviously). You have to buy a real certificate from a vendor or use a service.

Some links found on a quick google search:

• https://www.reddit.com/r/electronjs/comments/17sizjf/a_guide_to_code_signing_certificates_for_the/
• https://azure.microsoft.com/en-us/products/artifact-signing#pricing
• https://gist.github.com/MangaD/e8f67fb39a35abdbf4ad26711c5957cc