ClickOnce, Windows 8+, SmartScreen, Unknown Publisher & EV Certificate

Question

In an attempt to eliminate the Smart Screen warning in Windows 8+, my company purchased an EV Certificate from Symantec
to use for a software product we produce. Specifically it is called: Symantec Class 3 Extended Validation Code Signing CA – G2.
We use Visual Studio 2013 for development and ClickOnce as our installer.  When we first installed the certificate
into ClickOnce, we were unable to publish because of an “unexpected internal error” problem.  We solved that problem by applying the fix detailed
here:
http://social.msdn.microsoft.com/Forums/windows/en-US/073aa844-26e6-42ef-a0ea-05c58dd29199/project-publish-with-digicert-signtool-error-an-unexpected-internal-error-has-occurred
Now we can build and publish and the Smart Screen warning in Windows 8+ is gone.  However,
the install dialogs produced by our ClickOnce installer are showing:
Publisher: Unknown Publisher
We have read dozens of forum postings about possible ways
of fixing this problem by going outside of ClickOnce and running some combination of signtool.exe and mage.exe on various files.
While this may or may not work, we have a simple question: Is it possible to simply install an EV Certificate inside of
ClickOnce and then publish a version that both passes Smart Screen and shows the publisher name correctly?
Or, is there a bug in ClickOnce that prevents this?
It appears from our reading that ClickOnce has a bug, but we would like to have that confirmed or clarified by Microsoft.

Answer 1

Hi Michael,
Thanks for your response.  As you mentioned, there are a lot of variables here so it can be confusing.  Let me try to clarify:
Let me first tell you about our application.  We have two Windows components, both written in C# running under .NET.  One is a Windows Forms tray application implemented as an executable (.exe), and the other is an Outlook VSTO add-in implemented
as a dynamic link libaray (.dll).  We have separate ClickOnce installers for each component.  We need to offer our users a clean install experience on any Windows desktop version from Vista through 8+.
Prior to this week we used a Thawte Code Signing G2 certificate for our components. We implemented this by checking the “Sign The ClickOnce Manifests” box in Visual Studio 2013 and allowing ClickOnce to handle the signing tasks.  This worked well for
all installs up through Windows 7.  However, Windows 8 SmartScreen ignored the Thawte certificate and threw up an ugly warning.  We researched the problem, determined that we needed a different type of certificate and so we purchased a Symantec Class
3 Extended Validation Code Signing G2 certificate.
This is when we encountered ISSUE 1.  We selected the new EV certificate under the ClickOnce “Signing” option and attempted to build, and then we encountered the “unexpected internal error” problem you referred to.  We researched the problem, found
a fix and applied it.  The details of this part are given earlier so I won’t repeat them here.
At this point we were able to achieve successful builds for both components.  We published ClickOnce installers and both were able to install successfully on all versions of Windows without warning, and this included passing through Windows 8 SmartScreen
with no warning.
However, with both installers, on every version of Windows we now get an “Unknown Publisher” warning on this dialog:
http://lightrunner.com/images/unk-pub.png
The same dialog is shown on all versions of Windows.
I am currently in the process of trying every combination I can think of, of signing the executeables, dlls and manifests that ClickOnce is not signing to see if it solves the problem.  This requires running signtool.exe and mage.exe at different stages
in the build/publish cycle so it’s a bit tricky.  So far no luck. 
And, yes, I’ve tried everything in RobinDotNet’s blog posting and it hasn’t worked.  Still trying as of this posting.
Let me know if I’ve missed anything, or if any of this needs further clarification.
Best regards,
-Drew