2.6 Pre-distributing a Trusted Publisher Certificate for the Novell Client Installation

The Novell Client for Windows Vista uses Microsoft* Authenticode* digital signatures to verify Novell, Inc. as the publisher of Novell Client drivers, as is required by the latest versions of Windows. During the Novell Client installation, Windows presents an approval dialog box which lets you confirm whether software from Publisher: Novell, Inc. should be installed.

An Always trust software from Novell, Inc. option is also available. If you select this option, Windows Vista adds the Novell, Inc. certificate to the Windows Trusted Publishers certificate list for the current Windows machine. The next time this Windows machine encounters driver software signed with the same Novell, Inc. certificate, Windows proceeds with installation rather than prompting you again for confirmation.

If you want to keep Windows Vista from presenting this installation approval (for the Novell Client or for any other driver software using publisher-signed Authenticode signatures), you can pre-distribute the publisher's public certificate used for Authenticode signing to the Windows machines Trusted Publishers certificate list prior to installation of the driver software.

For the Novell Client, the certificate used for Authenticode signing is the Verisign* public certificate for Novell, Inc. The best way to obtain the correct certificate for use in the Trusted Publishers list is to install the Novell Client on a Windows machine, then select the Always trust software from Novell, Inc. option when prompted. Then use the Microsoft Certificate Management Console (certmgr.msc) to export the Novell, Inc. certificate visible in this Windows machine's Trusted Publishers certificate list.

The exported certificate can be used to pre-distribute Novell, Inc. as a Trusted Publishers certificate on Windows machines using any of the methods Microsoft makes available for pre-loading certificates used by Authenticode-signed software. This includes Microsoft support for distributing certificates during unattended installations of Windows, or through the use of Group Policies.

For more information on the options provided by Microsoft Windows for distributing software publisher certificates, see the “Deploying Authenticode Digital Certificates in an Enterprise” section of Using Authenticode to Digitally Sign Driver Packages for Windows Server 2003 (Authenticode.doc), and the following Microsoft Windows Group Policy documentation:

Certificates have an expiration date, and the certificate a software publisher uses will eventually change as the current certificate reaches expiration and a renewed certificate is obtained. For example, the certificate currently used to sign Novell Client for Windows Vista is valid until 2010, so pre-distributing this certificate will work for future Novell Client software releases until the year 2010.