Confused over Certificates

[KreativeKai]

I have many VS 2003 and 2005 (VB) projects being used within our organization. These applications are windows forms based and not web. The applications are click-once based and when I publish updates to the server, the clients can get updated automatically.

This all works great until a few months later. When installing the applications the screens warn that the application is not a trusted publisher, but I continue to install past this. The application seems to setup a temporary key/certificate that expires in a few months. When I make a change after the expiration date, I can obtain another temporary certificate from the certificate store for a few more months, but all my click once clients crash because the identity has changed.

My boss and his boss say they can buy a certificate for a specific server, but to me that doesn't make sense. Wouldn't you buy a certificate for the company and any application we create can use that certificate no matter where our client is executing the program.

I'm hoping someone can point me in the right direction.

Confused and not trusted

[TheCPUWizard]

No, the certificate is for a specific network identity. Many smaller companies will theefore purchase one certificate and put all their clickonce applications on the same server (for deployment/update purposes).

Think about it for a second from a security standpoint.

If the certificate was valid for the entire company, what you stop an employee from using their desktop computer to "spoof" the corporate server and commit major fraud???

You WANT the certificate to be assigned to a specific network location.