How to create a Software Publisher Certificate for internal use from a CA

Not that I am suggesting that there is any conspiracy to make money from hapless IT departments wishing to sign their internal applications, but...

Apart from purchasing a Software Publishing Certificate (SPC) from a commercial and recognised issuer there is a way to create a SPC using free tools and the PKI infrastructure in your organisation. This does have the disadvantage that you can only verify the application on PCs that have your organisation's root certificate installed in the Trusted Root Certificate Authorities partition. An easy thing to do with Group Policy, and also possible for non-domain computers that really require it without heavy lifting.

Whey would you want to do this? Anyone wanting to distribute custom applications or custom installers can now distribute their internally compiled software without reducing security levels. Want users to install an application on Vista or Windows 7 from the control panel when they need it? If it is not signed, it will not happen without a certificate.

So, how to do it? Requirements: An Enterprise CA (running on Windows Server 2008 Enterprise - important as you need to manage certificate templates - not possible on Standard editions,) OpenSSL, PVK from Code Sign here, and Microsoft Platform SDK (which, if you are developing, one assumes you are using.)

Another thing you need to identify is what you want to appear when you install an application and the UAC pops up. Typically, you will wnat your users to identify you as the source of the software, so somehting like "Company Name IT Department." I will refer to this later as "your certificate name."

On your CA you will need to right click Certificate Template and select Manage. In the templates Console you will need to create a code signing template. For our purposes I created a 2008 Enterprise Certificate with the extended purpose of Code Signing. Under request handling, "Allow private key to be exported" MUST be ticked. Under Subject Name ensure "Supply in the request" is set. Under Issuance Requirements ensure "CA certificate manage approval" is ticked. Click OK and close the Template Console.

In the CA Manager, right click Certificate Templates and select new -> Certificate template to issue. Select your newly created template.

Open a command prompt and run certmgr to open the certificate manager for the user account. Right click personal and select All tasks -> Request new certificate. Click next until you see a list of certificates you can enrol for. You should now see your new certificate template with a warning "More information is required..." (because you selected the "Supply in the request" option.) Tick this certificate template, expand and click on Properties. In the Subject tab, select "Common Name" from the drop down list and enter your certificate name as noted above. Click Add. You may want to identify this certificate later by added a friendly name and description under the general tab. When finished, click OK. Click on Enroll and you should be told that the request is pending.

In the CA Manager, note the Request ID (important for later) and approve the request. We are not finished with the CA Manager yet...

In certmgr, refresh the tree and you will have a Certificate Enrollment Requests branch. Expand this to find a certificate with issued to "your certificate name" (as noted above) and issued by "your certificate name" with a private key, specifying a password. This is practically useless, but we need to to get the Private Key. Export the certificate with the private key to a pfx file. Use openssl to extract the private key to a PEM file:

openssl pkcs12 -in filename.pfx -nocerts -nodes -out filename.pem

This extracts the key after specifying the password noted above. The certificate is useless to us, so once you have the PEM file, you can practically dispose of this certificate. Now you need to convert the PEM to a PVK file.

pvk -in filename.pem -topvk -out filename.pck

You will be asked to specify a new password for the private key and to re key it to verify. This password will be needed later to sign installers - so remember it.

Because of the bug in the certificate (it being issued by itself and therefore untrusted) you now need to retrieve the certificate from the CA. In CA Manager, go to Issued Certificates and list them in Request ID order. Find the Request ID (noted when you approved the request) and double click the request to view the certificate details. Note that this version of the certificate has no private key and is issued to "Your certificate name" but is correctly issued by your CA. This is what we want. On the details tab, click the "Copy to File" button to begin the export wizard. Save the certificate as a DER X.509 certificate with a .spc extension. (A .cer extension will do, but for the purposes of identifying this file later, let's just give it .spc)

Okay you now have a .spc certificate with code signing extensions, and a .pvk file that corresponds to the .spc certificate. In order to turn this into something useful, you now need to use the Platform SDK Tools:

pvk2pfx.exe -pvk filename.pvk -pi password -spc filename.spc -pfx newfilename.pfx -po password

The password corresponds to the important password you noted when creating the pvk file. I would keep the second password the same. If you import this pfx file you will now have the correct certificate, with the correct extension, subject and issued by, for signing your installers.

Finally, for ease of use, I use Tech-Pro's codesign from within Visual Studio's tools menu to do all my signing (because it works.) Of course you may use signtool and the command line or any other method using this certificate. Now all my installers are signed and can be used within the organisation without the need to reduce security AND I can continue to distribute them via active directory just as I do with commercial applications.

SharePoint Mysteries

SharePoint can do some pretty weird stuff. One day everyone is publishing quite happily. The next, they cannot add a new page, and some page properties give errors. They are normally presented with an "Error: Access Denied" page even though they are presented with the link to create a new page. While we have not traced what causes this, we have been able to fix it. The problem lies with Page Layouts and Style Libraries.

To resolve the issue, you will first have to log into the site as a site owner. Go to the top site and then Site Actions, All Site Settings, and select Master pages and page layouts. Go to Document Library Settings and click Permissions for this document library. Now add the group that you want to be able to create pages to this list and select at least "Restricted Read."

Now go back to your top site and select "View All Site Content" and select "Style Library." Once again go to Document Library Settings and click Permissions for this document library. Again add the group that you want to be able to create pages to this list and select at least "Restricted Read."

Your users will once again be able to create pages. Keep an eye on this, because we have suspicions that there is some automated process that clears the permissions for these libraries, possibly an update.

Windows 7 will push back the tide...

When Windows Vista arrived, everyone had a good excuse to go to Linux. The hardware specifications were hard on old hardware. Even PCs that were just above specification they lagged quite badly if you ran too many applications side by side. Ubuntu, though derided by Linux die-hards, has brought Linux to the masses. Easy installation and hardware compatibility makes installing Linux on a 2-3 year old laptop a breeze, and a viable option against staying with a compromised, buggy XP or moving to the lagging new secure Vista.

However, if you were expecting to see blistering speeds, forget it. There was a time when you could load Unreal Tournament on a like for like Linux PC and push all the sliders to the right, when you could only go half way on Windows. While gaming performance may still be better, the desktop certainly lags. KDE 4, shipping with the latest versions of Ubuntu provides a nice shine, but does not impress with program launch times. Even Gnome, now the flavour of Linux, does provide a measure of speed, but is so unfamilier to traditionally Windows users. It still lags when launching programs. Add to this the difficulty in managing Wireless connectivity.

After 9 months of KDE 4, I finally decided to go back to Windows. With the release of Windows 7, I was impressed with the apparant lightness on a low processor, 1Gb RAM laptop. Vista is do-able on that specification, but it lags and makes your hardware feel like a dog. Windows 7 provides the response time not far off how it felt when you first loaded XP (before all the addons and start programs are added to drag XP into the quagmire.) Windows 7 was installed in around 30 minutes. Hardware drivers were mostly installed within 10 minutes (after running a Windows Update) and one driver in particular took some hunting down (the lastest sound drivers did not work, I had to use an early driver.)

All in all, it was quicker to install Windows than it was to install Linux. And the wireless, once configured, just worked, without constant wallet passwords or dropping out after hibernation. If this is the way Windows is going, there is no reason for the average person to turn to Linux any more, other than the price.

But then again in the business of life and business, would you not rather pay for something that works out of the box? Or would you rather spend time on getting a free product working. Time is money, you know. How much does Linux really cost?

Migrating to vSphere (VI4 for those that know)

Migrating to vSphere 4 from VI3 is a very easy process. There are a, however, couple of gotchas you need to look out for.

But first, are there many good reasons to upgrade from VI3? There are some nifty feature additions in the background: Virtual IDE controllers and USB may be a good reason to upgrade. And of course there is better 64 bit support. Add to that a greater range of settings and a sparkling new interface for vCenter, making administration a little easier. Permissions are scaled out to all objects. And, of course, there is the vNetwork Switch (an expensive step up to Enterprise Plus.) This makes your networking datacentre based, as opposed to machine based, which means your switch ports migrate with your VM, reducing packet loss and maintaining connection integrity.

And now the Gotchas:

vCenter Update Manager now works differently. No longer are the Hosts defences switched off in order to scan or run updates. Instead, the hosts communication with vCenter over port 80 to collect update definitions. vCenter proxies this to the Update Manager, running on whatever you set it to on installation. Of course, if you have a proxy server set on the server, you need to make sure that the local IP address of the Update Manager is excluded, or you could be spending the day trying to figure out why updates do not work...

Setup of the client tools is the shakiest yet. For a start, the new version of the tools requires a complete uninstal of the older version. This in itself is not a bad thing, unless the previous version cannot uninstall itself without leaving parts of itself all over your server. Look up VMware KB Article 1001354 (http://kb.vmware.com/kb/1001354) you will get very familier with it. After attempting an uninstall and falls over in spectular failure, run through the KB article, removing all the remenants of the previous installation. Then run setup64.exe to install the latest tools. A reboot is required. It's possible that trying to uninstall 32bit tools and then install the new 64bit tools. Hopefully the next upgrade will not be so painfull.

Finally, after completing the upgrade, put each of the hosts into maintenance mode and watch for VMs that refuse to migrate. One of the reasons for failure to migrate is hardware. vSphere 4 introduces more hardware virtualisation, such as USB ports. If you previously P2V'd a physical machine or a VMware Server VM, with VI3.5 it ignored the USB ports. vSphere 4 recognises the USB but does not quite integrate the original settings and therefore cannot migrate the VM. For these VMs, a simple edit of virtual hardware will resolve these problems. But you want to find these out sooner rather than later.

Happy migrations...

Google Chrome, a new OS?

Hmmm. "Introducing the Google Chrome OS" states the headline on the official Google Blog for July 2009. Other's hail the end of Microsoft as we know it as a 'New OS' comes on the scene. Oh please! Of course Microsoft will adapt to changes in the market. But will Microsoft fall to something that's been around for years?

A careful read of the above blog will reveal that the Google Chrome OS is "Google Chrome running within a new windowing system on top of a Linux kernel." Google Chrome is, of course, based on an Apple WebKit. Effectively, it is Safari in another guise. So, for the new recipe, take one Apple Web Kit, stick it as the sole application on a new Desktop Manager (see Gnome or KDE as examples of a desktop manager), and bake it on Linux. Bottle with pure hype and brand it "Google!" Does anyone see Microsoft running scared from this?

The technology is old, but the difference will be how Google packages the technology. And that will be what Microsoft has to be wary of!

nslookup and DNS on Server 2008

Testing your new Server 2008 DNS server and finding that the primary domain returns nothing but root server referrals? We did. Using nslookup requires an extra command if you are running this test on a client with a default domain name:

set srchlist=.

If you do not set this, the client appends its current domain to the search query. The response is that the server has not a clue what you are talking about and returns a root server referral (which, by the way, is the correct behaviour.)

It is noted that this is not the same behaviour for a Server 2003 DNS server.

Updates with attitude - Exchange with Forefront and VMware

We stumbled across these. I hope you can avoid the same issues.

Firstly Exchange with Forefront Security...

Symptom:
When you reboot your Exchange 2007 SP1 Hub and Edge role servers where you have Forefront for Exchange installed, you find that no mail is flowing.

Cause:
Some Forefront Services do not pull themselves up in time after rebooting. Consequently the Exchange Transport service which relies on Forefront being up and ready for action, fails to start. A manual start of the Exchange Transport service works with no issues.

Solution:
Remember to manually start your services after rebooting! There is rumoured to be a fix for Forefront in Update Rollup 4 or SP2 or both... See here Don't hold your breath.

Secondly VMware Whatsitcalled?

You may be aware that VI 3.5 update 4 is out since the end of March. For owners of VI 2.x or 3.x (other than 3.5 in any form) there are clear instructions on how to upgrade your infrastructure. It is worth following these to the letter. However, if, like us, you were running VI 3.5, the instructions end up being anything but clear.

First thing to note in all of this is that is that they have changed the names of their products. See here. VMware is now being very Microsoft-esque by sticking v next to a bunch of previous used names and calling products 'server' when in fact it is just an over hungry application. Nevertheless, get used to vCenter Server instead of Virutal Server and vConverter... well you get the drift.

So how to update to VI 3.5 update 4?

The first step is to download the VMware vCenter Server 2.5 Update 4 - includes Converter Enterprise (formerly VMware VirtualCenter) from the VMware download page. After doing all possible backups, run the installation and install vCenter 2.5 update 4 along with the latest version of the VI Client and Updater.

The second step is to update the ESX Hosts. This is where the documentation breaks down. I thought that the old ways of copying binaries and using boot disks was gone... Well, it is. Stop looking for esxupdate.zip, that for VI 3.0.x. Instead, open the VIC and install and enable the updater plugin. When you scan for updates you will now see an extra dozen or so updates that you could not see previously. Once you have applied these, you will note that the build number for your ESX servers goes up to 153875. Welcome to Update 4.

The final step is now to go into each VM and update to the latest VMware tools. How do I know this is the way to go? Check out the actual update for VI 3.5 update 4. It is downloadable from the VMware Downloads site. It is simply a xml list of updates that need to be applied to make Update 4. There are no binaries with the update itself.

Happy updating!!!