Do I really need to sign my VSTO Add-in Click Once Manifests?

Question

When I worked on our Excel Add-in project, I remember getting some compiler error or warning in VS 2012 (I don't remember the exact wording or why it manifested) but it was something along the lines of the Click Once Manifests needed to be signed. At the
time I went through the steps of self-signing the Add-in's .dll using a PFK file I generated via VS and then installed on our local Dev machines and the build machine. Further into the project an Installer was eventually created for the Add-In using WiX. Recently
the certificate is saying it's expired. Before we go through the steps of updating the certificate, can someone explain to me if we even need to sign the manifests at all if we're using a custom installer? 

Answer 1

Hello jasonlbeal,
In my experience it has been totally worth signing the add-in dll(s) and the msi in my builds.
Anytime I've had a Click Once fail or an Add-in not load it's always because it needed to be signed.
Sometimes it bites me right away and sometimes it's down the line when IT decides to enforce a GPO requiring all add-in's to be trusted.
Not really an explanation of WHY but just sharing my input saying in my travels it's completely worth the headache to maintain a signing cert.
I hope that helps sir.
Thank you, <br/> <br/> Nick Metnik <br/> <br/> Please mark my response as helpful if it has helped you in any way or as the answer if it is a valid solution.<br/> <a href="http://nickmetnik.wordpress.com/">Blog</a><br/>
<a href="https://www.linkedin.com/in/nickmetnik">LinkedIn</a> <br/><br/>Some of the best connections I made in the past were SQL connections.<br/> - ME