Internet Explorer crashes when loading signed ocx

Question

I have a .ocx / ActiveX library that I encoded in Delphi. I have thoroughly tested this library in the following environments:

Windows XP SP3 - IE6 Windows XP SP3 - IE7 Windows XP SP3 - IE8 Windows 7 Ultimate 64 bit - IE 9 (32 bit)

The library interacts with my IIS server, then loads the MsRdpClient library interface, then starts an RDP session inside the client area of ​​the browser. It works great.

Now this deployment time will be deployed to the client’s site on the network. Users will receive / download ocx to their computer, accessing the client network using VPN, etc.

We bought a code signing certificate from Go Daddy. Using the Microsoft Conformity Mark, I have successfully signed ocx. Here is the process I used:

I downloaded my certificate from GoDaddy. I installed the certificate in IE. I exported the certificate from IE to the .pfx file, the private key, and that’s it. I successfully signed the certificate using the signtool sign. I also tested the signing of the certificate using the old signtool (6.1), using the signtool signwizard and the pvk utility, creating a pvk file and linking it to the .spc file received from GoDaddy.

The first time I try to load ocx on a web page, I will be asked to accept the object from a trusted authority. Then it resets IE!

After the first time / after downloading the certificate and approving the object, as soon as I try to start my site with an ActiveX, IE 7, 8, and 9 error!

I do not receive any error messages, the browser just "leaves"!

This is deployment time, and I have no information from IE about what is going on. Any help would be greatly appreciated!

Answer 1

When signing a file code, the contents of the file change, and the file length increases. The signature is inserted into the file.

If you have anti-mortise code in the program, you can run it by simply signing the file. For example, if you use EurekaLog, make sure that you have disabled the option "Check file corruption (anti-crack)", otherwise your program will fail with the error "This file has been hacked" simply because the signature changed the file.

Typically, you should disable any such unauthorized access protection code before signing the application and use the Windows API to verify the validity of the signature. The signature will be invalid if the file was modified after it was signed. Eldos SecureBlackBox components have features for verifying signatures from an application.

Also, consider using a timestamp when signing a file. Without a timestamp, once your code signing certificate has expired, the signature will expire. With a timestamp, the signature works even after the expiration of your code signing certificate (unless you have canceled the certificate).