Code Signing Adobe AIR applications with DigiCert

I'm posting this because the process of signing an Adobe AIR application should be simple, yet it isn't and the instructions on the DigiCert site doesn't really help.

First off I purchased a certificated from DigiCert. For under $200 a year, not too bad. After several days they eventually sent it, they have to verify your a real company and actually call you etc.

The certificate comes in the form of a link in an email. You click the link and it installs the certificate into your browser / system. From there DigiCert offer instructions for IE users and for Firefox users how to export it. I was using chrome, but with luck the ie instructions apply.

So it says to go into mmc add in the Certificates snap in, under personal, find the certificate, right click export. So that was easy enough, I did that generated it, plugged it into Flash Builder and made my AIR file.

Here's where it gets interesting.

Firstly you may get a weird warning when trying to install your AIR app about it being corrupt or similar, this really means that your application has changed but the id is the same and it cant compare the one you have to the one you want. Simple solution, uninstall any current version of your application.

With that done, I built it again, and it worked, except I still had the Not Trusted red X, no company name etc, whats going on? After looking around for a bit, I looked at my certificate and it's not valid. Its not valid because the root certificate couldn't be trusted.

Simple fix is to find the root certificate on the DigiCert website, and install it, make sure you pick to choose the location, it needs to go into Trusted Root Certification Authorities. If you go back and look at your certificate, you will see its now valid.

Root certificates for DigiCert are available here
The one I needed was DigiCert Assured ID Root CA which was visible from the certification path tab.

Rebuild the package and all is good.

Make sure that when exporting you tick Yes to export the private Key, and tick the Include all certificates in the certification path if possible. When you export it will ask for a password, use that same password when selecting your certificate from Flash Builder.