Security prompt for unsigned add-ins

[DurkeeBrown]

I have three unsigned add-ins installed in Revit 2017, and I realize that Revit now produces a security prompt when loading unsigned add-ins.  What I don't understand is why clicking the "Always Load" button in response to the security prompt does not permanently eliminate the prompt for the add-in in question.  I find that I still intermittently get prompted about the same three add-ins occasionally.  In case it's helpful, the add-ins are:

• BIME_purgecad_command (C:\ProgramData\Autodesk\ApplicationPlugins\BIME_Purge Unused Cad Files.bundle\Contents\2017\BIME_Purge Unused Cad Files.dll)
• LMNts View Renumber (C:\ProgramData\Autodesk\Revit\Addins\2017\LMNts.Utilities.ViewRenumber.dll)
• ArchSmarter PowerPack (C:\ProgramData\Autodesk\ApplicationPlugins\ArchSmarterPowerPack.bundle\Contents\2017\PowerPack_2017.dll)

Anyone have suggestions regarding how to make the "Always Load" decision stick?

Thanks,

George Hasapidis

DBVW Architects

[Troy_Gates]

I have this issue with every computer on our company network. It appears that some IT settings have prevented signed addins from loading their certificate into the computer.

Here is a thread on RevitForum.org on what people are doing to install the certificates manually: https://www.revitforum.org/architecture-general-revit-questions/31547-revit-2017-signed-addins-not-a...

[jeremytammik · Accepted solution]

Dear George,

Currently, the ultimate source of truth on this topic is still this thread:

https://forums.autodesk.com/t5/revit-api-forum/code-signing-of-revit-addins/td-p/5981560

Cheers,

Jeremy

[DurkeeBrown]

Thanks Jeremy.  The add-ins I'm having trouble with do not have certificates associated with them, so I see now why it's impossible for me to completely eliminate the security prompt unless I create and install my own certificates, as recommended in the thread.  I'll give that a shot.  Thanks again for your help.

[DurkeeBrown]

Thanks Troy.  As it turns out, the add-ins I'm having trouble with did not come with certificates, so there's nothing to install, manually or otherwise.  I'm looking into creating my own certificates to go with the add-ins.  Thanks again for responding.

[Dale.Bartlett]

I will be interested in any feedback. We have some (only) computers on the network that continually ask the Always Load question. In other cases answering Always Load does what is expected, i.e. does not ask again until the addin changes. We also do not have certificates, and cannot edit the registry without getting access to the original 10 Commandments and making it 11. Using Revit 2017 and it has only happened recently. Dale

[Troy_Gates]

For unsigned addins, you can add their addin GUID to the registry to prevent the "Always Load" prompt from coming up.

You can find my original explaination here: https://www.revitforum.org/architecture-general-revit-questions/31547-revit-2017-signed-addins-not-a...

Here is what I posted:

Unsigned certificates
I have created a batch file that will create a registry DWORD (32-bit) Value for each of the addins in the following location:

Code:

HKEY_CURRENT_USER\SOFTWARE\Autodesk\Revit\Autodesk Revit 2017\CodeSigning\

The name of the DWORD is the GUID found inside the .addin file called <AddInId>. The DWORD value is 1. (See screenshot attached below)


Here is an example for importing my BIM Consortium addin, which is currently unsigned, into the registry. You can add all of the addin GUIDs to the reg file instead of doing each one individually.

bimcon.reg file:

Code:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Autodesk\Revit\Autodesk Revit 2017\CodeSigning]
"08286877-1fdf-4dec-bb62-0a6259c5aedb"=dword:00000001

bimcon.bat file

Code:

reg import bimcon.reg

[DurkeeBrown]

Update: I self-signed one of the add-ins I'm having trouble with using my own CA, but unfortunately I'm still occasionally getting the prompt about that add-in (along with the other two, which I did not sign yet).  I have verified, from the text of the security prompt, that Revit is looking at the new, signed version of the .dll file, based on the time-date stamp displayed.  So self-signing the add-in's .dll file is not working for me.

I then tried to implement Troy's suggestion of manually adding the DWORD key with the GUID for my add-in, with value 1, to my registry, but when I made this attempt I found that such a DWORD key already existed, so I could not add it again (due to the conflict in the key names, both being named for the same GUID).  Apparently I already had that implemented, but it also is not preventing the occasional security prompt.

I'm open to any other suggestions, but it's starting to look like my users will just have to live with this occasional annoyance, at least until we upgrade to Revit 2018, and/or drop the use of the three add-ins that are triggering the security prompts, or until the creators of the add-ins issue signed versions.

George

[bcampbell11]

Is this still a viable solution to self signing plugins?

Thanks