title: VSTO ClickOnce self signed certificate and Trusted Publisher
body: <p>I have two certificates which looks the same to me but apparently not to ClickOnce deployment process. Both certificates are self-signed and both are in Trusted Root Zone on the machine where the application will be installed (thus they both don't have issuer, they are roots).</p>
  
  <p>One of those certificates is generated using Visual Studio publish tab using "Create Test Certificate" button and the other one is generated by me using openssl cli</p>
  
  <p>Here's how they look in cert preview</p>
  
  <ol>
  <li>created with VS</li>
  </ol>
  
  <p><a href="https://i.stack.imgur.com/EU60f.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/EU60f.png" alt="enter image description here"></a></p>
  
  <ol start="2">
  <li>created with opensll</li>
  </ol>
  
  <p><a href="https://i.stack.imgur.com/SKcXM.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/SKcXM.png" alt="enter image description here"></a></p>
  
  <p>Now, the one generated with Visual Studio appears as Trusted Publisher when I install the app whereas my certificate is shown as Untrusted (however when I check the certificate manually - it appears as trusted in Windows).</p>
  
  <p>Here are cli commands I'm using to create certificate using openssl. Note that I'm using the default openssl config (version 1.0.2h)</p>
  
  <pre><code>openssl genrsa -out ca.key 4096
  openssl req -new -x509 -days 999 -key ca.key -out ca.crt
  openssl pkcs12 -export -in ca.crt -inkey ca.key -out ca.p12
  </code></pre>
  
  <p>I can't figure out why my certificate appears as untrusted, that is, what VS cert generator does more than I do in openssl. How can I see and compare the properties of both certificates to see what differs them that matters for ClickOnce installer.</p>
  
  <p>I also tried to explicitly specify that the certificate is for Code Signing (in the Extended Key Usage) -- the result was still the same</p>