newbie problems with certutil and signtool

Discussion:

David Tiertant

2009-02-03 16:48:45 UTC

Howdy,

I'm working in InstallShield to create a web installer for one of our
software packages. The installer for IE builds fine, but Firefox
requires a Netscape certificate. InstallShield is supposed to build this
automatically, but something is wrong with my settings and I'm having
some difficulty getting the certificate created manually, using certutil
and signtool.

- I'm running Windows XP
- I've downloaded NSS 3.6 and NSPR 4.6 from ftp.mozilla.org
- I've copied the files from these packages to my working directory,
C:\Program Files\InstallShield\2009\System

I'm using NSS 3.6 because the InstallShield setup will look for cert7.db
instead of cert8.db. Newer versions of NSS create a cert8.db. I don't
know which version of NSPR I should be using. I know that signtool.exe
is Mozilla's version, not Microsoft's.

The first thing I tried to do in cmd prompt was change to my working
directory and run certutil -N -d .
This prompted me to enter a password 3 times. Then the program finished.
It created 3 .db files.

I ran...

certutil -S -x -k rsa -n mozillaCertificate -s "CN=mozillaCertificate,
O=My Company, C=US" -t "TCu" -d .

It had me type a bunch of random keys and enter a password for "NSS
Certificate DB" again. Then came "Generating key. This may take a few
moments..." and that was the end.

I then closed my Mozilla apps and ran signtool -p"mypassword123" -k
mozillaCertificate .

It generated a bunch of files and then at zigbert.sf
signtool: PROBLEM signing data (Certificate not approved for this
operation)
the tree "." was NOT SUCCESSFULLY SIGNED

So I went back and do a certutil -L and out came this.
certutil: NSS_Initialize failed: security library: bad database.

There's some user error involved somewhere. I was an art student, so
I'll admit I am a tad out of my element. Any assistance will be greatly
appreciated. Thanks in advance.

David

David Tiertant

2009-02-03 17:50:09 UTC

Permalink

Post by David Tiertant
Howdy,
I'm working in InstallShield to create a web installer for one of our
software packages. The installer for IE builds fine, but Firefox
requires a Netscape certificate. InstallShield is supposed to build this
automatically, but something is wrong with my settings and I'm having
some difficulty getting the certificate created manually, using certutil
and signtool.
- I'm running Windows XP
- I've downloaded NSS 3.6 and NSPR 4.6 from ftp.mozilla.org
- I've copied the files from these packages to my working directory,
C:\Program Files\InstallShield\2009\System
I'm using NSS 3.6 because the InstallShield setup will look for cert7.db
instead of cert8.db. Newer versions of NSS create a cert8.db. I don't
know which version of NSPR I should be using. I know that signtool.exe
is Mozilla's version, not Microsoft's.
The first thing I tried to do in cmd prompt was change to my working
directory and run certutil -N -d .
This prompted me to enter a password 3 times. Then the program finished.
It created 3 .db files.
I ran...
certutil -S -x -k rsa -n mozillaCertificate -s "CN=mozillaCertificate,
O=My Company, C=US" -t "TCu" -d .
It had me type a bunch of random keys and enter a password for "NSS
Certificate DB" again. Then came "Generating key. This may take a few
moments..." and that was the end.
I then closed my Mozilla apps and ran signtool -p"mypassword123" -k
mozillaCertificate .
It generated a bunch of files and then at zigbert.sf
signtool: PROBLEM signing data (Certificate not approved for this
operation)
the tree "." was NOT SUCCESSFULLY SIGNED
So I went back and do a certutil -L and out came this.
certutil: NSS_Initialize failed: security library: bad database.

Oops. Did this instead and received the expected output.

certutil -L -n mozillaCertificate -d .

Post by David Tiertant
There's some user error involved somewhere. I was an art student, so
I'll admit I am a tad out of my element. Any assistance will be greatly
appreciated. Thanks in advance.
David

David Tiertant

2009-02-03 17:54:26 UTC

Permalink

Still not signing correctly. :(

Post by David Tiertant

Post by David Tiertant
Howdy,
I'm working in InstallShield to create a web installer for one of our
software packages. The installer for IE builds fine, but Firefox
requires a Netscape certificate. InstallShield is supposed to build
this automatically, but something is wrong with my settings and I'm
having some difficulty getting the certificate created manually, using
certutil and signtool.
- I'm running Windows XP
- I've downloaded NSS 3.6 and NSPR 4.6 from ftp.mozilla.org
- I've copied the files from these packages to my working directory,
C:\Program Files\InstallShield\2009\System
I'm using NSS 3.6 because the InstallShield setup will look for
cert7.db instead of cert8.db. Newer versions of NSS create a cert8.db.
I don't know which version of NSPR I should be using. I know that
signtool.exe is Mozilla's version, not Microsoft's.
The first thing I tried to do in cmd prompt was change to my working
directory and run certutil -N -d .
This prompted me to enter a password 3 times. Then the program
finished. It created 3 .db files.
I ran...
certutil -S -x -k rsa -n mozillaCertificate -s "CN=mozillaCertificate,
O=My Company, C=US" -t "TCu" -d .
It had me type a bunch of random keys and enter a password for "NSS
Certificate DB" again. Then came "Generating key. This may take a few
moments..." and that was the end.
I then closed my Mozilla apps and ran signtool -p"mypassword123" -k
mozillaCertificate .
It generated a bunch of files and then at zigbert.sf
signtool: PROBLEM signing data (Certificate not approved for this
operation)
the tree "." was NOT SUCCESSFULLY SIGNED
So I went back and do a certutil -L and out came this.
certutil: NSS_Initialize failed: security library: bad database.

Oops. Did this instead and received the expected output.
certutil -L -n mozillaCertificate -d .

Nelson B Bolyard

2009-02-05 01:13:12 UTC

Permalink

Post by David Tiertant
I'm working in InstallShield to create a web installer for one of our
software packages. The installer for IE builds fine, but Firefox
requires a Netscape certificate. InstallShield is supposed to build this
automatically, but something is wrong with my settings and I'm having
some difficulty getting the certificate created manually, using certutil
and signtool.
I'm using NSS 3.6 because the InstallShield setup will look for cert7.db
instead of cert8.db. Newer versions of NSS create a cert8.db. I don't
know which version of NSPR I should be using. I know that signtool.exe
is Mozilla's version, not Microsoft's.

David,

I find your message intriguing, because it seems to say that InstallShield
(a Microsoft product, yes?) wants to use NSS cert databases. In all of my
nearly 13 years of working on NSS, this is the first time (that I can
recall) that anyone has suggested that any Microsoft product wants to use
NSS cert databases. So, I have numerous questions about all this.

Is there any public documentation (e.g. on a web site) that explains
about InstallShield's use of NSS and/or NSS cert databases?

I can't tell what you're trying to do exactly with InstallShield and
Firefox. I can't tell if you're trying to
- create an InstallShield installer that installs Firefox itself, or
- create an InstallShield installer that Firefox will download and
process, for the purpose of installing some add-on for Firefox, or
- something else

You wrote "Firefox requires a Netscape certificate". I don't understand
what you meant by that. There's no such thing as "a Netscape certificate",
and Firefox does not require things that it downloads to be signed or to
contain any certificate (AFAIK). Firefox downloads extensions in a format
known as "XPI" which stands for "Cross Platform Installer". An XPI file
is a JAR file, which is a ZIP file, whose contents are organized in a
specific hierarchical directory structure. Like all JAR files, XPI files
may be signed, but Firefox does not require that they be signed before
downloading and installing them. I'm not aware that InstallShield is
capable of making XPI files, so I'm really not sure what you're trying to do.

I wonder if it is possible that InstallShield really does NOT want to
use NSS, but rather that it is trying to run some Microsoft program,
but has accidentally run some NSS program instead. As I recall, both
NSS and Microsoft's Platform SDK (PSDK) have programs named signtool.
Might InstallShield have run NSS's signtool when it intended to run
PSDK's signtool instead?

I suspect that the real solution you need will either
- not involve NSS 3.6, or
- not involve InstallShield
but below, I will ignore that suspicion to address some specific issues.

Post by David Tiertant
The first thing I tried to do in cmd prompt was change to my working
directory and run certutil -N -d .
This prompted me to enter a password 3 times.

3 times? Doesn't sound right.

Post by David Tiertant
Then the program finished. It created 3 .db files.
I ran...
certutil -S -x -k rsa -n mozillaCertificate -s "CN=mozillaCertificate,
O=My Company, C=US" -t "TCu" -d .

I think you're trying to create an object signing certificate. There's
a lot more to it than that. If you generate your own self-signed object
signing certificate, it may may signtool work, but the signed results will
almost certainly not be satisfactory.

In any case, to generate an object signing cert, you need different trust
flags. Instead of "TCu", try ",,P". If that doesn't work, try ",,C".

Post by David Tiertant
I then closed my Mozilla apps and ran
signtool -p"mypassword123" -k mozillaCertificate .

That command seems to lack the -d "directory" option, telling signtool
the name of the directory in which to find the cert DBs. That will
generally not be the same directory as the directory containing the
contents of the JAR file being created.

Post by David Tiertant
It generated a bunch of files and then at zigbert.sf
signtool: PROBLEM signing data (Certificate not approved for this
operation)
the tree "." was NOT SUCCESSFULLY SIGNED

That's probably because of the trust flag issue I described above, but
could also be due to the absence of a -d option.

More thoughts:
Signtool is a tool for creating signed JAR files.
The version of signtool in NSS 3.6 does not know how to create XPI files.
That capability was added to signtool in NSS 3.10. I suggest you use
NSS 3.11.x or 3.12.x for signing XPI files. FF2 uses NSS 3.11.x,
FF3 uses NSS 3.12.x.

Signtool has its own option for generating self-signed object signing certs.
That might be more satisfactory than using certutil for that purpose.
Self-signed object signing certs are intended for your own testing only,
not for actual distribution of signed code (perhaps you knew that).

If you have a code signing cert for signing Windows code, that should work
for signing XPI files too. You will need to copy the cert and its private
key into an NSS database by exporting them from Windows into a .p12 (.pfx)
file and then importing that into NSS using NSS's pk12util.

It's still not clear what signtool and XPI files have to do with
InstallShield. I'd be really surprised if InstallShield makes any direct
use of NSS.

Kyle Hamilton

2009-02-05 02:11:17 UTC

Permalink

InstallShield is its own separate thing. Newer versions use the
Microsoft Installer (MSI) capability, but it is still made by Acresso
(spun off from Macrovision).

http://kb.acresso.com/doc/DocumentRepository/Installation/InstallShield/InstallShield%202009%20Express/01_Public/Product%20Manual/InstallShieldExpressEditionUserGuide.pdf

page 478 (sequential page 502) refers to "signing for Netscape Communicator".

-Kyle H

Post by Nelson B Bolyard

David,
I find your message intriguing, because it seems to say that InstallShield
(a Microsoft product, yes?) wants to use NSS cert databases. In all of my
nearly 13 years of working on NSS, this is the first time (that I can
recall) that anyone has suggested that any Microsoft product wants to use
NSS cert databases. So, I have numerous questions about all this.
Is there any public documentation (e.g. on a web site) that explains
about InstallShield's use of NSS and/or NSS cert databases?
I can't tell what you're trying to do exactly with InstallShield and
Firefox. I can't tell if you're trying to
- create an InstallShield installer that installs Firefox itself, or
- create an InstallShield installer that Firefox will download and
process, for the purpose of installing some add-on for Firefox, or
- something else
You wrote "Firefox requires a Netscape certificate". I don't understand
what you meant by that. There's no such thing as "a Netscape certificate",
and Firefox does not require things that it downloads to be signed or to
contain any certificate (AFAIK). Firefox downloads extensions in a format
known as "XPI" which stands for "Cross Platform Installer". An XPI file
is a JAR file, which is a ZIP file, whose contents are organized in a
specific hierarchical directory structure. Like all JAR files, XPI files
may be signed, but Firefox does not require that they be signed before
downloading and installing them. I'm not aware that InstallShield is
capable of making XPI files, so I'm really not sure what you're trying to do.
I wonder if it is possible that InstallShield really does NOT want to
use NSS, but rather that it is trying to run some Microsoft program,
but has accidentally run some NSS program instead. As I recall, both
NSS and Microsoft's Platform SDK (PSDK) have programs named signtool.
Might InstallShield have run NSS's signtool when it intended to run
PSDK's signtool instead?
I suspect that the real solution you need will either
- not involve NSS 3.6, or
- not involve InstallShield
but below, I will ignore that suspicion to address some specific issues.

Post by David Tiertant
The first thing I tried to do in cmd prompt was change to my working
directory and run certutil -N -d .
This prompted me to enter a password 3 times.

3 times? Doesn't sound right.

Post by David Tiertant
Then the program finished. It created 3 .db files.
I ran...
certutil -S -x -k rsa -n mozillaCertificate -s "CN=mozillaCertificate,
O=My Company, C=US" -t "TCu" -d .

I think you're trying to create an object signing certificate. There's
a lot more to it than that. If you generate your own self-signed object
signing certificate, it may may signtool work, but the signed results will
almost certainly not be satisfactory.
In any case, to generate an object signing cert, you need different trust
flags. Instead of "TCu", try ",,P". If that doesn't work, try ",,C".

Post by David Tiertant
I then closed my Mozilla apps and ran
signtool -p"mypassword123" -k mozillaCertificate .

Post by David Tiertant
It generated a bunch of files and then at zigbert.sf
signtool: PROBLEM signing data (Certificate not approved for this
operation)
the tree "." was NOT SUCCESSFULLY SIGNED

That's probably because of the trust flag issue I described above, but
could also be due to the absence of a -d option.
Signtool is a tool for creating signed JAR files.
The version of signtool in NSS 3.6 does not know how to create XPI files.
That capability was added to signtool in NSS 3.10. I suggest you use
NSS 3.11.x or 3.12.x for signing XPI files. FF2 uses NSS 3.11.x,
FF3 uses NSS 3.12.x.
Signtool has its own option for generating self-signed object signing certs.
That might be more satisfactory than using certutil for that purpose.
Self-signed object signing certs are intended for your own testing only,
not for actual distribution of signed code (perhaps you knew that).
If you have a code signing cert for signing Windows code, that should work
for signing XPI files too. You will need to copy the cert and its private
key into an NSS database by exporting them from Windows into a .p12 (.pfx)
file and then importing that into NSS using NSS's pk12util.
It's still not clear what signtool and XPI files have to do with
InstallShield. I'd be really surprised if InstallShield makes any direct
use of NSS.
--
dev-tech-crypto mailing list
https://lists.mozilla.org/listinfo/dev-tech-crypto

David Tiertant

2009-02-05 15:40:05 UTC

Permalink

Yes, this is a basic overview of the process for anyone interested in
the problem. Thanks!

Post by Kyle Hamilton
InstallShield is its own separate thing. Newer versions use the
Microsoft Installer (MSI) capability, but it is still made by Acresso
(spun off from Macrovision).
http://kb.acresso.com/doc/DocumentRepository/Installation/InstallShield/InstallShield%202009%20Express/01_Public/Product%20Manual/InstallShieldExpressEditionUserGuide.pdf
page 478 (sequential page 502) refers to "signing for Netscape Communicator".
-Kyle H

Post by Nelson B Bolyard

David,
I find your message intriguing, because it seems to say that InstallShield
(a Microsoft product, yes?) wants to use NSS cert databases. In all of my
nearly 13 years of working on NSS, this is the first time (that I can
recall) that anyone has suggested that any Microsoft product wants to use
NSS cert databases. So, I have numerous questions about all this.
Is there any public documentation (e.g. on a web site) that explains
about InstallShield's use of NSS and/or NSS cert databases?
I can't tell what you're trying to do exactly with InstallShield and
Firefox. I can't tell if you're trying to
- create an InstallShield installer that installs Firefox itself, or
- create an InstallShield installer that Firefox will download and
process, for the purpose of installing some add-on for Firefox, or
- something else
You wrote "Firefox requires a Netscape certificate". I don't understand
what you meant by that. There's no such thing as "a Netscape certificate",
and Firefox does not require things that it downloads to be signed or to
contain any certificate (AFAIK). Firefox downloads extensions in a format
known as "XPI" which stands for "Cross Platform Installer". An XPI file
is a JAR file, which is a ZIP file, whose contents are organized in a
specific hierarchical directory structure. Like all JAR files, XPI files
may be signed, but Firefox does not require that they be signed before
downloading and installing them. I'm not aware that InstallShield is
capable of making XPI files, so I'm really not sure what you're trying to do.
I wonder if it is possible that InstallShield really does NOT want to
use NSS, but rather that it is trying to run some Microsoft program,
but has accidentally run some NSS program instead. As I recall, both
NSS and Microsoft's Platform SDK (PSDK) have programs named signtool.
Might InstallShield have run NSS's signtool when it intended to run
PSDK's signtool instead?
I suspect that the real solution you need will either
- not involve NSS 3.6, or
- not involve InstallShield
but below, I will ignore that suspicion to address some specific issues.

Post by David Tiertant
The first thing I tried to do in cmd prompt was change to my working
directory and run certutil -N -d .
This prompted me to enter a password 3 times.

3 times? Doesn't sound right.

Post by David Tiertant
Then the program finished. It created 3 .db files.
I ran...
certutil -S -x -k rsa -n mozillaCertificate -s "CN=mozillaCertificate,
O=My Company, C=US" -t "TCu" -d .

I think you're trying to create an object signing certificate. There's
a lot more to it than that. If you generate your own self-signed object
signing certificate, it may may signtool work, but the signed results will
almost certainly not be satisfactory.
In any case, to generate an object signing cert, you need different trust
flags. Instead of "TCu", try ",,P". If that doesn't work, try ",,C".

Post by David Tiertant
I then closed my Mozilla apps and ran
signtool -p"mypassword123" -k mozillaCertificate .

Post by David Tiertant
It generated a bunch of files and then at zigbert.sf
signtool: PROBLEM signing data (Certificate not approved for this
operation)
the tree "." was NOT SUCCESSFULLY SIGNED

David Tiertant

2009-02-05 15:35:34 UTC

Permalink

Hi and thanks very much for the reply. Just to back things up a little
bit, I'll try to illustrate what I would like to accomplish. I work for
a software company and we typically distribute our software on CD media.
The software is fairly specialized and only works when connected to a
server, either on the customer site or hosted by a team of our
consultants. To cut down on distribution costs and eliminate the waiting
period for our users between placing an order and receiving the
software, we're going to try to install the software over the web. So
InstallShield will build a bunch of files and we'll load them onto the
server and the customer will have a private URL to download and update
their software. A test example is shown in the first link.

Loading Image...

As we can see, this process works as expected in Internet Explorer. But...

Loading Image...

When we test in Firefox, the installer hangs, with the error at the
bottom left: Applet ISSetupApplet notinited. Oops.

Loading Image...

So in InstallShield, I set "Browsers to Support" to include Netscape, on
which Firefox was built. As noted, "If you want the installation to
support Netscape Communicator, you must supply certificate information."
So I've done this.

Unfortunately, the process is hardly automatic. InstallShield Support
tells me to download NSS, NSPR and extract the packages to the working
directory (Netscape Certificate Path in the last screenshot) and
certutil and signtool will build the certificate in the same directory.

All I should have to do is specify basic info in these 3 Netscape fields
in InstallShield. InstallShield should take care of the rest. It should
automatically create a signed install.jar, but it doesn't. See the nasty
error below.

Loading Image...

So InstallShield Support wants me to verify that certutil and signtool
are functioning manually. The error code and KB article referenced, if
anyone is curious, is here:
http://kb.acresso.com/selfservice/microsites/search.do?cmd=displayKC&docType=kc&externalId=Q108219&sliceId=1&docTypeID=DT_ERRDOC_1_1&dialogID=44705413&stateId=0%200%2044701989

A lot of troubleshooting went into this before ending up with this build
error. One thing I remember distinctly is that InstallShield was looking
for cert7.db instead of the cert8.db that I had created with a newer
version of NSS, thus prompting the downgrade. InstallShield came
packaged with a Microsoft version of signtool, so I made sure to get the
Netscape version, shown here:

Loading Image...

InstallShield Support doesn't feel like working with me again until I've
verified that the process is working manually. Hehe...A couple of days
ago, I got to the point where I successfully created a test certificate
using the syntax previously mentioned, but signtool failed to sign it. I
specified the working directory using -d .
I think you may be on to something with the trust flags being off. I'll
try to rebuild the certificate and databases using different flags,
import them into Firefox, and we'll see what happens...

Thanks again,
David

Post by Nelson B Bolyard

David,
I find your message intriguing, because it seems to say that InstallShield
(a Microsoft product, yes?) wants to use NSS cert databases. In all of my
nearly 13 years of working on NSS, this is the first time (that I can
recall) that anyone has suggested that any Microsoft product wants to use
NSS cert databases. So, I have numerous questions about all this.
Is there any public documentation (e.g. on a web site) that explains
about InstallShield's use of NSS and/or NSS cert databases?
I can't tell what you're trying to do exactly with InstallShield and
Firefox. I can't tell if you're trying to
- create an InstallShield installer that installs Firefox itself, or
- create an InstallShield installer that Firefox will download and
process, for the purpose of installing some add-on for Firefox, or
- something else
You wrote "Firefox requires a Netscape certificate". I don't understand
what you meant by that. There's no such thing as "a Netscape certificate",
and Firefox does not require things that it downloads to be signed or to
contain any certificate (AFAIK). Firefox downloads extensions in a format
known as "XPI" which stands for "Cross Platform Installer". An XPI file
is a JAR file, which is a ZIP file, whose contents are organized in a
specific hierarchical directory structure. Like all JAR files, XPI files
may be signed, but Firefox does not require that they be signed before
downloading and installing them. I'm not aware that InstallShield is
capable of making XPI files, so I'm really not sure what you're trying to do.
I wonder if it is possible that InstallShield really does NOT want to
use NSS, but rather that it is trying to run some Microsoft program,
but has accidentally run some NSS program instead. As I recall, both
NSS and Microsoft's Platform SDK (PSDK) have programs named signtool.
Might InstallShield have run NSS's signtool when it intended to run
PSDK's signtool instead?
I suspect that the real solution you need will either
- not involve NSS 3.6, or
- not involve InstallShield
but below, I will ignore that suspicion to address some specific issues.

Post by David Tiertant
The first thing I tried to do in cmd prompt was change to my working
directory and run certutil -N -d .
This prompted me to enter a password 3 times.

3 times? Doesn't sound right.

Post by David Tiertant
Then the program finished. It created 3 .db files.
I ran...
certutil -S -x -k rsa -n mozillaCertificate -s "CN=mozillaCertificate,
O=My Company, C=US" -t "TCu" -d .

I think you're trying to create an object signing certificate. There's
a lot more to it than that. If you generate your own self-signed object
signing certificate, it may may signtool work, but the signed results will
almost certainly not be satisfactory.
In any case, to generate an object signing cert, you need different trust
flags. Instead of "TCu", try ",,P". If that doesn't work, try ",,C".

Post by David Tiertant
I then closed my Mozilla apps and ran
signtool -p"mypassword123" -k mozillaCertificate .

Post by David Tiertant
It generated a bunch of files and then at zigbert.sf
signtool: PROBLEM signing data (Certificate not approved for this
operation)
the tree "." was NOT SUCCESSFULLY SIGNED

Nelson B Bolyard

2009-02-05 23:46:41 UTC

Permalink

Thanks to David and Kyle for supplying information about InstallShield
and its use of NSS for making Netscape Communicator compatible installers.

Post by David Tiertant
Hi and thanks very much for the reply. Just to back things up a little
bit, I'll try to illustrate what I would like to accomplish. I work for
a software company and we typically distribute our software on CD media.
The software is fairly specialized and only works when connected to a
server, either on the customer site or hosted by a team of our
consultants. To cut down on distribution costs and eliminate the waiting
period for our users between placing an order and receiving the
software, we're going to try to install the software over the web.

Does your software become part of the browser itself, and run in the browser
as a browser extension or plug-in? Or are you merely trying to use the
browser to download a file that will then be installed as a free-standing
Windows application?

This is important because the XPI download feature for which NSS's signtool
makes signed JAR/XPI files is intended only for installing files that become
part of the browser itself. It is not intended to be used as a
general purpose installer for Windows software that does not run as part
of the browser.

If you're trying to download a program that does not run as part of the
browser, but runs independently as a separate Windows program, then you
really don't want to use XPI files for that purpose, IMO. In that case,
you just want to download whatever kind of installer package is used by
windows to install the package into windows. You just want to use the
browser as a file downloader, which does not require that they be XPI
files.

As I recall, one of the really important features of InstallShield is its
ability to make packages that will uninstall cleanly after they've been
installed, and can be uninstalled using Windows' "add/remove software"
control panel. Things that are installed as XPIs are managed by Firefox's
addon manager.

Post by David Tiertant
So in InstallShield, I set "Browsers to Support" to include Netscape, on
which Firefox was built. As noted, "If you want the installation to
support Netscape Communicator, you must supply certificate information."

So, apparently, InstallShield has a feature to make installers that are
compatible with Netscape Communicator (NC). Firefox (FF) is not built on
top of NC, although it does support many old features of NC. FF is
actively being developed, but AFAIK, Netscape browsers are no longer
being developed and have not been for years now. So, today, you should
be targeting FF, not NC.

FF has different requirements for installable downloads than NC had.
FF requires XPI files, which are special JAR files. NC required ordinary
JAR files. All XPI files are JAR files, but not all JAR files are XPI
files. NC required JAR files to be signed, IIRC, but FF does not require
XPI files to be signed.

Based on what I've read here, I gather that InstallShield is using a 6+
year old version of NSS to build JAR files for installation by a 6+ year
old NC browser that is no longer made. I was surprised to find that the
documentation to which Kyle pointed me is dated in 2009, yet it still
refers to Netscape and not to Mozilla or Firefox. I gather that
InstallShield is insisting on generating signed JARs because that is what
NC wanted, even though FF does not require them. Perhaps the customers
who are paying for that software should request that it be brought up to
date.

Post by David Tiertant
Unfortunately, the process is hardly automatic. InstallShield Support
tells me to download NSS, NSPR and extract the packages to the working
directory (Netscape Certificate Path in the last screenshot) and
certutil and signtool will build the certificate in the same directory.

I'm pretty amazed that they didn't at least supply a set of those files
that they have tested and know to work with their own product.

There are (at least) 3 directories involved:
- the directory where the executables and DLLs should be placed,
- the directory where the .db files (e.g. cert and key DBs) should go, and
- the directory which is the "root" of the JAR/XPI file being built.
These should generally all be separate directories. The executables should
go in "Program files", probably in the same directory as InstallShield's
own executables and DLLs. The .DB files should probably go into a directory
somewhere under "My Documents", and the root of the JAR file
should probably go in some "temp" directory. In your case, it's probably
important that the files go wherever InstallShield expects to find them,
but do take care that the DB files don't end up in the root JAR directory
or any subdirectory thereof.

Post by David Tiertant
All I should have to do is specify basic info in these 3 Netscape fields
in InstallShield. InstallShield should take care of the rest.

Once you have your code signing certificate and private key properly
installed in the DB files, then it might.

Post by David Tiertant
One thing I remember distinctly is that InstallShield was looking
for cert7.db instead of the cert8.db that I had created with a newer
version of NSS, thus prompting the downgrade.

:( That's most unfortunate, IMO. If there was a problem with signtool,
you can be sure that any new "fixed" version would not work with cert7,
but would work with cert8 or cert9.

Post by David Tiertant
InstallShield came packaged with a Microsoft version of signtool, so I

Post by David Tiertant
InstallShield Support doesn't feel like working with me again until I've
verified that the process is working manually.

:( IMO, it is reasonable that you would supply your own code signing cert
and private key, but beyond that...

Post by David Tiertant
A couple of days ago, I got to the point where I successfully created a
test certificate using the syntax previously mentioned, but signtool
failed to sign it. I specified the working directory using -d .

-d specifies the directory where the DBs live, but after that you must
also supply the name of the directory that is the root of the files to
be placed into the generated JAR.

David Tiertant

2009-02-06 16:23:32 UTC

Permalink

Post by Nelson B Bolyard
Does your software become part of the browser itself, and run in the browser
as a browser extension or plug-in? Or are you merely trying to use the
browser to download a file that will then be installed as a free-standing
Windows application?

It's not part of the browser, and it's not an extension or a plug-in.
All it does is path to the MSI and CAB files stored on the server. These
are downloaded and the installer runs and installs our software. Again,
it's a standalone Windows application.

Post by Nelson B Bolyard
This is important because the XPI download feature for which NSS's signtool
makes signed JAR/XPI files is intended only for installing files that become
part of the browser itself. It is not intended to be used as a
general purpose installer for Windows software that does not run as part
of the browser.
If you're trying to download a program that does not run as part of the
browser, but runs independently as a separate Windows program, then you
really don't want to use XPI files for that purpose, IMO. In that case,
you just want to download whatever kind of installer package is used by
windows to install the package into windows. You just want to use the
browser as a file downloader, which does not require that they be XPI
files.
As I recall, one of the really important features of InstallShield is its
ability to make packages that will uninstall cleanly after they've been
installed, and can be uninstalled using Windows' "add/remove software"
control panel. Things that are installed as XPIs are managed by Firefox's
addon manager.

This is correct. XPIs are not involved in this process. The browser is
only used as a file downloader, as you said.

Post by Nelson B Bolyard

I wish it was that simple. The only options in the newest version of
InstallShield are "IE Only" and "IE and Netscape". It does not mention
Firefox explicitly. I could be completely wrong, as I'm not a developer,
but since Firefox was built on Netscape technology and this is the
latest version of InstallShield, this would be the correct option if
it's supported in Firefox at all. Or is that just wishful thinking?

Post by Nelson B Bolyard
FF has different requirements for installable downloads than NC had.
FF requires XPI files, which are special JAR files. NC required ordinary
JAR files. All XPI files are JAR files, but not all JAR files are XPI
files. NC required JAR files to be signed, IIRC, but FF does not require
XPI files to be signed.
Based on what I've read here, I gather that InstallShield is using a 6+
year old version of NSS to build JAR files for installation by a 6+ year
old NC browser that is no longer made. I was surprised to find that the
documentation to which Kyle pointed me is dated in 2009, yet it still
refers to Netscape and not to Mozilla or Firefox. I gather that
InstallShield is insisting on generating signed JARs because that is what
NC wanted, even though FF does not require them. Perhaps the customers
who are paying for that software should request that it be brought up to
date.

This request is officially in!

Post by Nelson B Bolyard

I'm pretty amazed that they didn't at least supply a set of those files
that they have tested and know to work with their own product.

Because of legal issues, InstallShield cannot redistribute third party
software. This is very common (it affects my company as well). However,
that should not stop them from providing solid documentation on the
process, as well as suggesting exactly which versions of the NSS and
NSPR packages to download from Mozilla. My company is very small and we
do this for our customers. I really expected better from a company that
is its industry's leader.

In related news, as of last month, Firefox has become the most common
web browser, beating out IE in market share, 45.5% to 44.8%, according
to http://www.w3schools.com/browsers/browsers_stats.asp

While this is cause for celebration, we all hope that software vendors
will catch up to reality and do their best to add full support for the
best products on the market.

Post by Nelson B Bolyard
- the directory where the executables and DLLs should be placed,
- the directory where the .db files (e.g. cert and key DBs) should go, and
- the directory which is the "root" of the JAR/XPI file being built.
These should generally all be separate directories. The executables should
go in "Program files", probably in the same directory as InstallShield's
own executables and DLLs. The .DB files should probably go into a directory
somewhere under "My Documents", and the root of the JAR file
should probably go in some "temp" directory. In your case, it's probably
important that the files go wherever InstallShield expects to find them,
but do take care that the DB files don't end up in the root JAR directory
or any subdirectory thereof.

The installer builds a Release Folder, where all of the files go after a
build, whether the process was successful or not. I'm not sure where
the JAR would actually go. It would be created by InstallShield, but it
stops at the point of failure and does not continue the build.

Post by Nelson B Bolyard

Post by David Tiertant
All I should have to do is specify basic info in these 3 Netscape fields
in InstallShield. InstallShield should take care of the rest.

Once you have your code signing certificate and private key properly
installed in the DB files, then it might.

:( That's most unfortunate, IMO. If there was a problem with signtool,
you can be sure that any new "fixed" version would not work with cert7,
but would work with cert8 or cert9.

Post by David Tiertant
InstallShield came packaged with a Microsoft version of signtool, so I

Post by David Tiertant
InstallShield Support doesn't feel like working with me again until I've
verified that the process is working manually.

:( IMO, it is reasonable that you would supply your own code signing cert
and private key, but beyond that...

-d specifies the directory where the DBs live, but after that you must
also supply the name of the directory that is the root of the files to
be placed into the generated JAR.

I've tried a temporary folder, something like -d c:\buildhereplease but
signtool gave me the same old usage directions.

Thanks again!
David

David Tiertant

2009-02-05 15:52:51 UTC

Permalink

Interestingly enough, when I tried to include -d, signtool refused to do
anything other than spit out its syntax help. The process runs when
removing -d. It ends in an error (as you stated, probably related to
trust flags), but it runs. Could this be a bug in signtool? This is
shown below.

Loading Image...

David

Post by Nelson B Bolyard

Post by David Tiertant
I then closed my Mozilla apps and ran
signtool -p"mypassword123" -k mozillaCertificate .

Post by David Tiertant
It generated a bunch of files and then at zigbert.sf
signtool: PROBLEM signing data (Certificate not approved for this
operation)
the tree "." was NOT SUCCESSFULLY SIGNED

That's probably because of the trust flag issue I described above, but
could also be due to the absence of a -d option.

David Tiertant

2009-02-05 16:40:07 UTC

Permalink

And now...

Loading Image...

This shows that I have to create the DBs using certutil -N -d . first or
I get the security authorization error when attempting to create the
certificate. So I delete the DBs, create new empty ones, then create a
certificate using trust flag ",,P" (also tried ",,C"), then it prompts
for the password for "NSS Certificate DB", which is presumably what I
typed in when doing certutil -N -d .

Loading Image...

This shows that the certificate was created inside the database. I then
closed Mozilla products and ran signtool. -d was still causing problems,
but when I left it out, it complained with the same error. I think it
doesn't understand the directory "." which I'm sort of forced to use
because it doesn't like "-d ."

Maybe a newer version of signtool won't be such a little bitch about it.

David

Post by David Tiertant
Interestingly enough, when I tried to include -d, signtool refused to do
anything other than spit out its syntax help. The process runs when
removing -d. It ends in an error (as you stated, probably related to
trust flags), but it runs. Could this be a bug in signtool? This is
shown below.
http://david.tiertant.com/installshield/006.jpg
David

Post by Nelson B Bolyard

I then closed my Mozilla apps and ran signtool -p"mypassword123" -k
mozillaCertificate .

It generated a bunch of files and then at zigbert.sf
signtool: PROBLEM signing data (Certificate not approved for this
operation)
the tree "." was NOT SUCCESSFULLY SIGNED

That's probably because of the trust flag issue I described above, but
could also be due to the absence of a -d option.

Nelson B Bolyard

2009-02-05 22:46:11 UTC

Permalink

It's unfortunate that signtool doesn't do a better job of telling you
what's wrong with the command when it outputs the usage message.
In this case, the final argument is missing. The final argument is
the path name of the directory that will be the "root" directory of
the JAR file it creates. Note that, in general, this should not be
the same directory that contains the DB files.

David Tiertant

2009-02-06 16:24:41 UTC

Permalink

This could be the release folder...I'll give it a try.

Post by Nelson B Bolyard