Code signing of Revit Addins

[harrymattison]

Considering the new requirement in 2017 for Revit Addin signing, does anyone have recommendations

1. Which vendor to use to buy the certificate (presumably someone listed at http://social.technet.microsoft.com/wiki/contents/documents/2592.windows-root-certificate-program-me...
2. What is the "right" certificate to buy?

For example, how about the "CODE SIGNING CERTIFICATE" for $170/yr (if you buy 3 years)?

Validates and secures your code

Eliminates security warnings during download and installation

Protects with your choice of SHA-1 or SHA-2 encryption

https://www.godaddy.com/web-security/code-signing-certificate

[RichardBinning2010]

Hi Neil,

We are experiencing this on our network as well.  It seems to be intermittent, always load works for a while, then all of a sudden, 8 popups 1 for each addin.

Could this be related to updated Revit.ini by chance?

[matthew_taylor]

One mistake I made recently was that the certificate expired. Perhaps that is why the issue happens 'all of a sudden'?

[rbinning345]

No, its still occurring, with no change to certificates. 

Could it be related to a Revit.ini update?

[rita.aguiar]

Hi
Is the only way to automatically load a Revit plugin a Code Signing certificate?

[lecartuchen]

Neil. Exquisite explanation. Thanks a lot.

BTW, is there an updated official documentation on this matter? Would you please provide a link? Thanks @jeremytammik 

[jeremytammik]

Yes, sure. It is explained in detail in the developer guide:

https://help.autodesk.com/view/RVT/2021/ENU/?guid=Revit_API_Revit_API_Developers_Guide_Introduction_...

[lecartuchen]

Thanks @jeremytammik  and @neil.smithline  for your time. I really appreciate it.

I'm new to this world of code signing certificates. I've been reading a lot but still have two more questions for you guys.

1. How do I know if the CA I buy a code signing certificate from is a trusted one? I mean what if it is not in your list (Simantec, Digicert, Verisign, Thawte)? These certificates are very expensive for startup developers so I better know before hand if it is a recognized CA or not.
2. Let's say I bought a certificate. Signed my add-in appropriately and published yeyyy!!!. Within 3~4 months I have a revised improved version of my add-in codewise. Can I re-use the same certificate? If this certificate is valid for 1 or more years, I can't find confirmation that I can re-use it as many times I need. Is that an accurate asumption?

Thanks a lot in advance.

[jeremytammik]

Thank you for your appreciation. 

For your more specific detailed questions on code signing in general, I would suggest researching further in the standard .NET community and asking your vendor, since those questions are not related to the Revit API.

[boostyourbim]

@lecartuchen 

Here is some info about how I am signing my dll's and msi files.

https://boostyourbim.wordpress.com/2016/05/04/code-signing-for-revit-2017/

I am able to re-use this certificate as many times as I want.

[RevitBuilder43]

This functionality is now available in the Autodesk App Store.

YouTube: https://www.youtube.com/watch?v=b0PXfTu7xyw

Download: https://apps.autodesk.com/RVT/ru/Detail/Index?id=6172229355984601104&appLang=en&os=Win64