Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

InstallShield: Deploying Signed Package Without Outbound Internet Access

Posted on 2012-04-03
6
845 Views
Last Modified: 2012-04-07
Using IS 2009 Premier:
MSI: Basic
Certificate: Thawte

Trying to find out how to install a signed package on a machine that does not have outbound internet access.

We are deploying a web application (customer will have IIS 7).

Thanks,

Rick
0
Comment
Question by:sadlermd
  • 3
  • 3
6 Comments
 
LVL 40

Expert Comment

by:Vadim Rapp
ID: 37803835
Should be no problem at all. Having signed code does not mean you need internet connection in order to use it.
0
 

Assisted Solution

by:sadlermd
sadlermd earned 0 total points
ID: 37806758
I found the answer - you must make sure that the root certificate is found on the target computer.

When we tried installing our application on servers where outbound internet access was not available, we got a 1330 error that included a 266 error message: "Error 266 was returned by WinVerifyTrust".

After we imported the required root certificates, the problem went away.

http://www.verisign.com/support/roots.html
0
 

Author Comment

by:sadlermd
ID: 37806901
I've requested that this question be closed as follows:

Accepted answer: 0 points for sadlermd's comment #37806758

for the following reason:

works...
0
Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
LVL 40

Assisted Solution

by:Vadim Rapp
Vadim Rapp earned 500 total points
ID: 37806902
The original question was answered in the comment 37803835. The problem with the machine not having root certificate is different - the initial set of root certificates is installed with Windows; later they may be updated, but not doing it only results in problems when the machine encounters a certificate signed by signing authority unknown to it. In that case the administrator must obtain the root certificate of the authority who signed the certificate, and decide whether he trusts it or not.  This can be acbieved by obtaining updated Microsoft list, if this authority is there; but you can also obtain it directly from the authority that signed it - such as if you work with a developer, who can produce his certificate but does not want to pay Verisign hundreds of dollars, because he is working only for you so he can simply send you his certificate and you make it trusted in your organization; it's equally possible to refuse to trust an authority from Microsoft list if you want to. Also you can simply put this specific certificate into enterprise trust.

In any case, the answer to the original question "how to install a signed package on a machine that does not have outbound internet access" is "you don't need internet access to install signed package". If there are further problems, like in this case, they should be dealt with accordingly.

The proposed answer answers entirely different problem, described in the answer itself.
0
 

Accepted Solution

by:
sadlermd earned 0 total points
ID: 37808039
Asking *how* to do something implies directions - and although it is true you don't need internet access to install signed packages, it does require a couple of things  be in place for it to work!

How to install a signed package when outbound internet access is not available:

1. Make sure required root certificate(s) is on the target computer (use mmc.exe to check)
2. If not, add (import) them (be sure to provide a link to root certificates)
3. Run installation

If the root certificate doesn't exist and the cert can't authenticate via the internet, the installation will throw a 1330 error along with a 266 error...

Hope this helps...
0
 
LVL 40

Expert Comment

by:Vadim Rapp
ID: 37808172
No, I'd say it's easier than that.

1. launch the installation
  2a if there's no error (which is in 99%), then enjoy the product.
  2b. if there's an error, find out what the error is and address accordingly.
      3. if #2b is difficult, than post the error on E-E and seek help. So this question would be not "how to run installation w/o internet" but "what to do with error xxx".

Since in 99% it's 2a, no need to even think about root certificates before you run the installation.
0

Featured Post

Networking for the Cloud Era

Join Microsoft and Riverbed for a discussion and demonstration of enhancements to SteelConnect:
-One-click orchestration and cloud connectivity in Azure environments
-Tight integration of SD-WAN and WAN optimization capabilities
-Scalability and resiliency equal to a data center

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

One of the frequent problems with the installations is when some file or registry entry is not removed from the system upon un-installation of the product. Clean removal is always highly desirable. One major reason for that is badly authored inst…
I have been scripting applications way too long and can never remember how to create an ISS file.  So I decided to write this article to act as my own knowledge base for future reference, and hope you will also benefit. An ISS file is a response …

790 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question