Symantec WINDOWS INSTALLER EDITOR 7.0 SP2 - REFERENCE FOR WISE INSTALLATION EXPRESS V1.0 Installation Manual page 289

Windows Installer Editor Reference
You can avoid this problem by signing patches that will be run under Windows Vista or
later operating system. To do so:
Make sure that the original installation was digitally signed.
Add a digital signature to the patch, using the same certificate that was used to sign
the original installation.
When the patch is applied, the Windows Vista or later operating system performs the
elevation for the application. This means that a standard user can run the update, and
does not have to provide administrator authorization to run the application.
Digital signature methods
The file signing tool that is used to digitally sign a file depends on the type of your digital
certificate:
Public/private key pair files
This method requires a credentials file (.SPC or .CER) and a private key file (.PVK).
This method is supported by the signcode.exe tool. For details, search for
"Signcode" in the MSDN Library (msdn.microsoft.com/library/).
Personal Information Exchange file
This method requires a Personal Information Exchange file (.PFX), which is a
container file for the public/private key information. This method is supported by
the signtool.exe tool. For details, search for "Signtool" in the MSDN Library
(msdn.microsoft.com/library/).
Requirements
You must have a valid code signing certificate, which you can obtain from a
commercial certificate authority such as Verisign. For a list of certificate authorities,
search for "Microsoft Root Certificate Program Members" in the MSDN Library
(msdn.microsoft.com/library/).
You must have the signtool.exe or signcode.exe tool on your computer.
Signtool.exe requires the CAPICOM 2.0 redistributable to be installed and registered
on your computer. CAPICOM provides services for digitally signing applications, and
is available from the Microsoft Web site.
The location of signtool.exe or signcode.exe must be specified on the Digital
Signature tab in Wise Options, or they must be available on the system path.
Also search for "User Account Control (UAC) Patching" in the MSDN Library
(msdn.microsoft.com/library).
To add a digital signature to a patch:
1. In the Patch Creation tool, on the Specify Upgrade Version page, mark Add a
Digital Signature to the Patch and click Next.
See Creating a Patch File
2. Complete the Specify Digital Signature Settings page:
Web URL
Enter your organization's Web site address.
Descriptive Name
Enter the name of your application. This name is embedded in your Authenticode
certificate to let end users verify the name of the application they are installing.
on page 284.
Upgrading Applications
289