Security - Signed Add-In error

[Anonymous]

I have been working with  Autodesk techs for several weeks and they cannot seem to come up with a solution to the error message I get when I fire up Revit 2019.2.1

I am greeted with a pop-up message "Security - Signed Add-In" for the add-in app DPR Model Slicer. Although I choose 'Always Load', the certificate is not loaded into Revit or the Windows registry.

I have loaded other 'signed add-ins' and get the same error message. However,  when an UNSIGNED add-in is loaded, I get the options to Always Load, Load Once, Do Not Load. Choosing Always Load, the pop-up is never seen again and the add-in is loaded into the Windows registry. Here is the catch, the error only appears in Revit 2019...not 2018 or 2020...???

Does anyone here have a clue what can be done to resolve this nuisance pop-up window without simply removing add-ins that I use every day and have used without faults for several years?

[mattmas]

I'm not sure why Autodesk has never really properly implemented the "Always Load" dialog box.

But I think you're basically stuck.

If an addin is not digitally signed, and if the certificate for that signature is not installed on the machine, then you're out of luck. And lots of addin developers (and occasionally Autodesk) have neglected to sign their DLLs.

Your options are basically to remove the addin, or buy your own digital signature and sign the files yourself.

Good Luck,

Matt

[Anonymous]

Thanks Matt,
The add-in is legit, signed, valid, current, etc. Autodesk has the DLLs for the app and had no problem with install/use when they tested. I have given them error logs for Revit showing the cause of the error yet they have not offered a solution.
I appreciate your input.

[mattmas]

Ah - well, that's a different story.

If you've confirmed that the DLL is signed (right click on it and see that it's got a valid "Digital Signatures" tab on the file).

Then the issue is that one of the certificates in the "certificate chain" is not present on your windows machine. When you get something signed, there's usually a chain of trust:

- This DLL is signed by your key.

- Your key is trusted by an intermediate signing authority

- The intermediate signing authority is trusted by a "root" signing authority.

In order for your machine to know that it is fully trusted, both the intermediate and the root signing authority certificates must be present on your machine.

(the installers for some of our product runs "certmgr" to import any of the necessary pieces into your Windows certification store).

So start by going back to the DLL, and look at the "Digital Signatures" tab, and dig into the details on the certificate. You'll eventually get to a "Certificate Path", and you can click on each link in the chain and see which one is missing. In the past, if I found something missing with someone else's DLL, it may be possible to download the missing piece from the publisher (i.e.  "Go Daddy Secure Certificate Authority - G2" can be downloaded from GoDaddy.com).

-Matt

[Anonymous]

Matt that all sounds very interesting. However, the DLL was sent to Autodesk support team and according to them the cert is ok...
I followed your suggestion and as best I can tell, the cert appears to comply with your guidelines...
Would it be possible for me to share the DLL with you so you verify my findings? Perhaps I am just not savvy enough but this all seems pretty simple.
Thanks,

[jeremytammik]

Dear Ed,

Thank you for your query, and very many thanks to Matt for his valuable advice, more knowledgeable than mine.

Very sorry to hear that you got no helpful response from Autodesk.

You might be interested in the main discussion thread and source of all public knowledge on this topic, the Trusted Digital Add-in Signature:

http://forums.autodesk.com/t5/revit-api/code-signing-of-revit-addins/m-p/5981560

You also need to be aware of the official help documentation on the topic ... I hope you already are:

http://help.autodesk.com/view/RVT/2020/ENU/?guid=Revit_API_Revit_API_Developers_Guide_Introduction_A...

Anyway, one valuable piece of information that you can glean from the main discussion thread above is the name of the Autodesk expert on this question, Neil Smithline, @neil.smithline:

https://forums.autodesk.com/t5/user/viewprofilepage/user-id/2812104

If all else fails, he should be able to help.

Best regards,

Jeremy

[Anonymous]

Jeremy,
Thanks for the information. However, I read those posts several weeks ago before I reached out to Autodesk Tech Support to resolve the issue with DPR Model Slicer signed certificate. ATS claims they cannot replicate the problem between Revit 2019.2.1 and DPR Model Slicer although they have received numerous Event Logs and the DLL for the add-in. Why this error only occurs with Revit 2019 is baffling; no problem with 2016, 2017, 2018.
The certificate is valid, from a trusted source. What is the issue? Seems pretty straight forward that someone inside Autodesk would know where these certs are supposed to go and just put it there or explain, in great detail to an End User that is not a PROGRAMMER, how to get the cert where it needs to be.
I pay good money for the numerous Autodesk suites I own and the Support that is supposed to come with it. NOT GETTING MY MONIES WORTH HERE!
Grr.

[jeremytammik]

Sorry to hear the problem persists and nobody can help so far.

It appears to be something pretty unique to your specific case...

I reached out to the product managers for you, asking for pointers as to who might be able to help better.

[jeremytammik]

Dear Ed,

Thank you for your patience.

I have not yet found the perfect person for you to discuss this with.

However, one of the product managers suggests:

In the meantime, he can probably try to remove the certificate that's installed on his machine for this app publisher and see if that helps store it properly when he tries to save it from 2019 again:

https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/how-to-view-certificates-with-...

In theory he can also import certificates here, but this is not my area of expertise.

I hope this helps.

Best regards,

Jeremy

[jeremytammik]

Dear Ed,

Another suggestion from the team:

The Issue is not generic. Once 'Always Load' is chosen, the authenticode certificate is registered in the Trusted Publishers certificate store, which would stop prompting the message.

We did a test on the reported app and it works fine registering the certificate in the desired location.

The user claims to have this issue on all signed DLLs, in Revit 2019.2.1 only. It seems to be a problem with his 2019.2.1 installation.

The user can confirm as shown below by typing 'certmgr.msc' from the Start button and navigating to 'Trusted Publishers' for the certificate:

I hope this helps.

Best regards,

Jeremy

[mark.ryanV3F5A · Accepted solution]

Hi @jeremytammik ,

Thanks for your diligence with this issue.  I've been working with @Anonymous  since it escalated to a support case and I wanted to close the loop. 

After @Anonymous purged out all traces of DPR Model Slicer add-in and uninstalled Revit 2019, we reinstalled both and looked to the Certificate Manager (certmgr) to see where the DPR Certificate landed.  Instead of in the "Trusted Publishers\Certificates" location, it was sitting in the "Trusted Root Certification Authorities\Certificates".  I simply dragged it into the location that you show in the above image and the "Always Load" pop-up dialog box stopped appearing.  

We are not sure where exactly in this process that the certificate was misplaced, but it is possible that there were multiple copies on the machine, so starting from scratch allowed us to isolate the location.

[Anonymous]

Mark,

Your the best! Thanks for all your time and patience with this matter.

Appreciation goes out to Matt and Jeremy for their input without which we may not be doing the 'happy dance'.

BIG THANKS GUYS!!

[mark.ryanV3F5A]

It was my pleasure, @Anonymous !

Likewise on your diligence and preparedness for each of our sessions.  

@jeremytammik  & @mattmas ... thank you for the input!