title: Signing a VSTO Excel Add-in, targeting .NET Framework 4.0, using a SHA-2 certificate
body: <p>I have a VSTO 2010 Excel add-in, targeting .Net Framework 4.0, Visual Studio 2010. </p>
  
  <p>We were using a SHA-1 certificate for the past few years for signing the manifest and the assemblies. The application has been deployed for a lot of end-users. Now with the SHA-1 deprecation policy coming into effect from January 2016, the renewed certificate that has been issued by the CA is keyed using SHA-256. </p>
  
  <p>Please have a look at the files generated by building a Excel 2010 VSTO Add-in, using various versions of Visual Studio:</p>
  
  <p>NOTE: The certificate used for all the following cases is keyed using SHA-2 algorithm.</p>
  
  <p><strong>.VSTO generated by VS 2010 SP1, Target Framework 4.0:</strong></p>
  
  <p>The <code>DigestMethod</code> Algorithm mentioned for the <code>dependentAssembly</code>'s <code>hash</code> is SHA1, even when SHA2 certificate was used.</p>
  
  <pre><code>&lt;dependentAssembly dependencyType="install" codebase="ExcelAddIn1.dll.manifest" size="18274"&gt;
      &lt;assemblyIdentity name="ExcelAddIn1.dll" version="1.0.0.1" publicKeyToken="2142698160a31911" language="neutral" processorArchitecture="msil" type="win32" /&gt;
      &lt;hash&gt;
          &lt;dsig:Transforms&gt;
              &lt;dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity" /&gt;
          &lt;/dsig:Transforms&gt;
          &lt;dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
          &lt;dsig:DigestValue&gt;DIGEST VALUE&lt;/dsig:DigestValue&gt;
      &lt;/hash&gt;
  &lt;/dependentAssembly&gt;
  </code></pre>
  
  <p>Under <code>publisherIdentity</code> tag, the <code>SignatureMethod</code> and the <code>DigestMethod</code> used is <strong>SHA256</strong>, which is according to the certificate's algorithm.</p>
  
  <pre><code>&lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha256" /&gt;
  
  &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha256" /&gt;
  </code></pre>
  
  <p><strong>.VSTO generated by VS 2013 SP4 and VS 2015, Target Framework 4.0:</strong></p>
  
  <p>Please note the algorithm mentioned in <code>&lt;dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;</code> tag is <strong>SHA1</strong>. Which is same as what gets generated by VS 2010.</p>
  
  <pre><code>&lt;dependentAssembly dependencyType="install" codebase="ExcelAddIn1.dll.manifest" size="16058"&gt;
      &lt;assemblyIdentity name="ExcelAddIn1.dll" version="1.0.0.0" publicKeyToken="2142698160a31911" language="neutral" processorArchitecture="msil" type="win32" /&gt;
      &lt;hash&gt;
          &lt;dsig:Transforms&gt;
              &lt;dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity" /&gt;
          &lt;/dsig:Transforms&gt;
          &lt;dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
          &lt;dsig:DigestValue&gt;DIGEST VALUE&lt;/dsig:DigestValue&gt;
      &lt;/hash&gt;
  &lt;/dependentAssembly&gt;
  </code></pre>
  
  <p>Similarly, under <code>publisherIdentity</code> tag, <code>SignatureMethod</code> and <code>DigestMethod</code> are still using <strong>SHA1</strong>. The .vsto file build using VS 2010 and VS 2013 SP1 are having <strong>SHA2</strong> here.</p>
  
  <pre><code>&lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /&gt;
  
  &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
  </code></pre>
  
  <p><em>Will this work/be supported even after January 2016/17?</em></p>
  
  <p><strong>.VSTO generated by VS 2013 SP4 and VS 2015, Target Framework 4.5.2:</strong></p>
  
  <p>Please note the algorithm mentioned in <code>&lt;dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha2" /&gt;</code> tag is <strong>SHA2</strong>.</p>
  
  <pre><code>&lt;dependentAssembly dependencyType="install" codebase="ExcelAddIn1.dll.manifest" size="16058"&gt;
      &lt;assemblyIdentity name="ExcelAddIn1.dll" version="1.0.0.0" publicKeyToken="2142698160a31911" language="neutral" processorArchitecture="msil" type="win32" /&gt;
      &lt;hash&gt;
          &lt;dsig:Transforms&gt;
               &lt;dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity" /&gt;
          &lt;/dsig:Transforms&gt;
          &lt;dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha2" /&gt;
          &lt;dsig:DigestValue&gt;DIGEST VALUE&lt;/dsig:DigestValue&gt;
      &lt;/hash&gt;
  &lt;/dependentAssembly&gt;
  </code></pre>
  
  <p><code>SignatureMethod</code> and <code>DigestMethod</code> are now indicating <strong>SHA2</strong> algorithm.</p>
  
  <pre><code>&lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha2" /&gt;
  
  &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha2" /&gt;
  </code></pre>
  
  <p>It seems that the update in VS 2013 SP3 (also available in VS 2015) is using/enforcing the algorithm as per the .Net Framework being targeted. </p>
  
  <p>For .Net Framework 4.0, the DigestMethod and SigntureMethod are always SHA1, irrespective of the certificate used. Now the add-in works on machine having only .Net 4.0 as the VSTO/clickonce loader does not have to deal with SHA2 at all.</p>
  
  <p>So, considering that SHA-2 certificates have to be used starting January 2016, what should be the configuration used for signing the add-in with SHA-2 certificate?</p>
  
  <ol>
  <li><p>VS 2010, .Net Framework 4.0 and SHA-2 certificate <em>(Does not work without .Net Framework 4.5 or newer installed on the machine)</em></p></li>
  <li><p>VS 2015, .Net Framework 4.0 and SHA-2 certificate <em>(This is no different from using SHA-1 certificates. The VSTO files have only SHA-1 entries, not sure whether this will work after January 2016)</em></p></li>
  <li><p>VS 2015, .Net Framework 4.5.2 and SHA-2 certificate <em>(Not suitable for me. I need to keep the target framework as 4.0)</em></p></li>
  </ol>
  
  <p>I am installing the Excel add-ins on machines offline. They are always loaded from the file system.</p>
  
  <pre><code>[HKEY_CURRENT_USER\Software\Microsoft\Office\Excel\Addins\ExcelAddin1]
  "Description"="ExcelAddin1 - COM add-in created with Visual Studio Tools for Office"
  "FriendlyName"="ExcelAddin1"
  "Manifest"="file:///C:/published/Addins/ExcelAddin1.vsto|vstolocal"
  "LoadBehavior"=dword:00000003
  </code></pre>
  
  <p>Thank you.</p>