Solved

InstallShield: Deploying Signed Package Without Outbound Internet Access

Posted on 2012-04-03
6
836 Views
Last Modified: 2012-04-07
Using IS 2009 Premier:
MSI: Basic
Certificate: Thawte

Trying to find out how to install a signed package on a machine that does not have outbound internet access.

We are deploying a web application (customer will have IIS 7).

Thanks,

Rick
0
Comment
Question by:sadlermd
  • 3
  • 3
6 Comments
 
LVL 40

Expert Comment

by:Vadim Rapp
ID: 37803835
Should be no problem at all. Having signed code does not mean you need internet connection in order to use it.
0
 

Assisted Solution

by:sadlermd
sadlermd earned 0 total points
ID: 37806758
I found the answer - you must make sure that the root certificate is found on the target computer.

When we tried installing our application on servers where outbound internet access was not available, we got a 1330 error that included a 266 error message: "Error 266 was returned by WinVerifyTrust".

After we imported the required root certificates, the problem went away.

http://www.verisign.com/support/roots.html
0
 

Author Comment

by:sadlermd
ID: 37806901
I've requested that this question be closed as follows:

Accepted answer: 0 points for sadlermd's comment #37806758

for the following reason:

works...
0
Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

 
LVL 40

Assisted Solution

by:Vadim Rapp
Vadim Rapp earned 500 total points
ID: 37806902
The original question was answered in the comment 37803835. The problem with the machine not having root certificate is different - the initial set of root certificates is installed with Windows; later they may be updated, but not doing it only results in problems when the machine encounters a certificate signed by signing authority unknown to it. In that case the administrator must obtain the root certificate of the authority who signed the certificate, and decide whether he trusts it or not.  This can be acbieved by obtaining updated Microsoft list, if this authority is there; but you can also obtain it directly from the authority that signed it - such as if you work with a developer, who can produce his certificate but does not want to pay Verisign hundreds of dollars, because he is working only for you so he can simply send you his certificate and you make it trusted in your organization; it's equally possible to refuse to trust an authority from Microsoft list if you want to. Also you can simply put this specific certificate into enterprise trust.

In any case, the answer to the original question "how to install a signed package on a machine that does not have outbound internet access" is "you don't need internet access to install signed package". If there are further problems, like in this case, they should be dealt with accordingly.

The proposed answer answers entirely different problem, described in the answer itself.
0
 

Accepted Solution

by:
sadlermd earned 0 total points
ID: 37808039
Asking *how* to do something implies directions - and although it is true you don't need internet access to install signed packages, it does require a couple of things  be in place for it to work!

How to install a signed package when outbound internet access is not available:

1. Make sure required root certificate(s) is on the target computer (use mmc.exe to check)
2. If not, add (import) them (be sure to provide a link to root certificates)
3. Run installation

If the root certificate doesn't exist and the cert can't authenticate via the internet, the installation will throw a 1330 error along with a 266 error...

Hope this helps...
0
 
LVL 40

Expert Comment

by:Vadim Rapp
ID: 37808172
No, I'd say it's easier than that.

1. launch the installation
  2a if there's no error (which is in 99%), then enjoy the product.
  2b. if there's an error, find out what the error is and address accordingly.
      3. if #2b is difficult, than post the error on E-E and seek help. So this question would be not "how to run installation w/o internet" but "what to do with error xxx".

Since in 99% it's 2a, no need to even think about root certificates before you run the installation.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I have been scripting applications way too long and can never remember how to create an ISS file.  So I decided to write this article to act as my own knowledge base for future reference, and hope you will also benefit. An ISS file is a response …
Monitor input from a computer is usually nothing special.  In this instance it prevented anyone from using the computer.  This was a preconfiguration that didn't work.
This tutorial gives a high-level tour of the interface of Marketo (a marketing automation tool to help businesses track and engage prospective customers and drive them to purchase). You will see the main areas including Marketing Activities, Design …
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now