title: How to Authenticode sign ClickOnce deployment with an EV SHA2 cert and avoid "Unknown Publisher"
body: <p>When signing my ClickOnce deployment via Visual Studio's project "Signing" settings page I specified our SHA2 (SHA256) EV Authenticode certificate and publish.</p>
  
  <p><a href="https://i.stack.imgur.com/OxFQE.png" rel="noreferrer"><img src="https://i.stack.imgur.com/OxFQE.png" alt="enter image description here"></a></p>
  
  <p>After publishing and attempting to run the bootstrapper (setup.exe) I'm presented with the "Unknown Publisher" in the ClickOnce dialog.</p>
  
  <p><a href="https://i.stack.imgur.com/dbUdG.png" rel="noreferrer"><img src="https://i.stack.imgur.com/dbUdG.png" alt="enter image description here"></a></p>
  
  <p>The EV certificate in question is valid and running on an eToken hardware token with SafeNet client tools to communicating with the token. Signing regular PE files (exe and dll) with signtool always produces perfectly valid assemblies and the publisher is known. <em>This is only an issue with ClickOnce deployments</em>. In addition, the individual files of the ClickOnce deployment look perfectly valid because the digital signatures tab of the file properties dialog is listed correctly for the bootstrapper (setup.exe) and the assembly files suffixed with ".deploy".</p>
  
  <p><a href="https://i.stack.imgur.com/WlRri.png" rel="noreferrer"><img src="https://i.stack.imgur.com/WlRri.png" alt="enter image description here"></a></p>
  
  <p>Also, the ".application" and ".manifest" files are appropriately mutated (probably via mage by Visual Studio) to contain the <code>&lt;publisherIdentity&gt;</code> element along with the algorithm set correctly.</p>
  
  <p><a href="https://i.stack.imgur.com/o9L0k.png" rel="noreferrer"><img src="https://i.stack.imgur.com/o9L0k.png" alt="enter image description here"></a></p>
  
  <p>The signing machine is running Win10 and I've tried every permutation I could imagine:</p>
  
  <ul>
  <li>With and without a timestamp</li>
  <li>With and without strong name signing</li>
  <li>With and without online publishing</li>
  <li>With and without https online publishing</li>
  <li>With and without specific "Update location" via Publish page</li>
  <li>With and without "Publisher name" set via Description in Publish page</li>
  <li>With every combination of Manifest options:
  
  <ul>
  <li>Exclude deployment provider URL</li>
  <li>Block application from being activated via a URL</li>
  <li>Use application manifest for trust information</li>
  </ul></li>
  <li>Multiple machines on various versions of Windows</li>
  <li>Manual manifest signing and assembly signing via mage and signtool (yes mageui as well)</li>
  <li>Ensure the cert is not revoked with certificate provider</li>
  </ul>
  
  <p>There appears to be <a href="https://social.msdn.microsoft.com/Forums/windows/en-US/af516753-a0b8-4fbe-aa73-e1feeb97a4cb/unknown-publisher-for-signed-clickonce-and-exe?forum=winformssetup&amp;prof=required" rel="noreferrer">someone else experiencing this</a>.</p>