VisualStudio.com can't load the temporary UWP certificate during builds

Question

I set up my Visual Studio Team Service account to clone my private GitHub repo and build the Windows UWP application anytime I queue a build. The cloning works without any issues; the compilation of every project (6) works except one. The Windows UWP app project.

I receive the following warnings while the build server compiles the app:

C:\Program Files (x86)\MSBuild\Microsoft\VisualStudio\v14.0\AppxPackage\Microsoft.AppXPackage.Targets(1778,5): Warning APPX0104: Certificate file 'myapp_TemporaryKey.pfx' not found.

2>C:\Program Files (x86)\MSBuild\Microsoft\VisualStudio\v14.0\AppxPackage\Microsoft.AppXPackage.Targets(1778,5): warning APPX0104: Certificate file 'myapp_TemporaryKey.pfx' not found. [C:\a\1\s\Source\Applications\myapp.WindowsUWP\myapp.csproj]

C:\Program Files (x86)\MSBuild\Microsoft\VisualStudio\v14.0\AppxPackage\Microsoft.AppXPackage.Targets(1778,5): Warning APPX0102: A certificate with thumbprint '58F2EA544193F6FC9F2737135570555B388E58D8' that is specified in the project cannot be found in the certificate store. Please specify a valid thumbprint in the project file.

2>C:\Program Files (x86)\MSBuild\Microsoft\VisualStudio\v14.0\AppxPackage\Microsoft.AppXPackage.Targets(1778,5): warning APPX0102: A certificate with thumbprint '58F2EA544193F6FC9F2737135570555B388E58D8' that is specified in the project cannot be found in the certificate store. Please specify a valid thumbprint in the project file. [C:\a\1\s\Source\Applications\myapp.WindowsUWP\myapp.csproj]

C:\Program Files (x86)\MSBuild\Microsoft\VisualStudio\v14.0\AppxPackage\Microsoft.AppXPackage.Targets(1778,5): Warning APPX0107: The certificate specified is not valid for signing. For more information about valid certificates, see http://go.microsoft.com/fwlink/?LinkID=241478. 2>C:\Program Files (x86)\MSBuild\Microsoft\VisualStudio\v14.0\AppxPackage\Microsoft.AppXPackage.Targets(1778,5): warning APPX0107: The certificate specified is not valid for signing. For more information about valid certificates, see http://go.microsoft.com/fwlink/?LinkID=241478. [C:\a\1\s\Source\Applications\myapp.WindowsUWP\myapp.csproj]

This is the last project out of the 6 to compile. After I receive the warnings, it proceeds to copy all of the output files over to the final /bin directory. Then when it's all done, reports the same messages as above, but as errors this time and fails the build.

_GenerateAppxPackageFile: C:\Program Files (x86)\Windows Kits\10\bin\x64\MakeAppx.exe pack /l /h sha256 /f obj\x86\Debug\package.map.txt /o /p C:\a\1\s\Source\Applications\MyApp.WindowsUWP\AppPackages\MyApp_1.0.0.0_x86_Debug_Test\MyApp_1.0.0.0_x86_Debug.appx
MyApp -> C:\a\1\s\Source\Applications\MyApp.WindowsUWP\AppPackages\MyApp_1.0.0.0_x86_Debug_Test\MyApp_1.0.0.0_x86_Debug.appx C:\Program Files (x86)\MSBuild\Microsoft\VisualStudio\v14.0\AppxPackage\Microsoft.AppXPackage.Targets(2382,5): Error APPX0104: Certificate file 'MyApp_TemporaryKey.pfx' not found. 2>C:\Program Files (x86)\MSBuild\Microsoft\VisualStudio\v14.0\AppxPackage\Microsoft.AppXPackage.Targets(2382,5): error APPX0104: Certificate file 'MyApp_TemporaryKey.pfx' not found. [C:\a\1\s\Source\Applications\MyApp.WindowsUWP\MyApp.csproj] C:\Program Files (x86)\MSBuild\Microsoft\VisualStudio\v14.0\AppxPackage\Microsoft.AppXPackage.Targets(2382,5): Error APPX0102: A certificate with thumbprint '58F2EA544193F6FC9F2737135570555B388E58D8' that is specified in the project cannot be found in the certificate store. Please specify a valid thumbprint in the project file. 2>C:\Program Files (x86)\MSBuild\Microsoft\VisualStudio\v14.0\AppxPackage\Microsoft.AppXPackage.Targets(2382,5): error APPX0102: A certificate with thumbprint '58F2EA544193F6FC9F2737135570555B388E58D8' that is specified in the project cannot be found in the certificate store. Please specify a valid thumbprint in the project file. [C:\a\1\s\Source\Applications\MyApp.WindowsUWP\MyApp.csproj] C:\Program Files (x86)\MSBuild\Microsoft\VisualStudio\v14.0\AppxPackage\Microsoft.AppXPackage.Targets(2382,5): Error APPX0107: The certificate specified is not valid for signing. For more information about valid certificates, see http://go.microsoft.com/fwlink/?LinkID=241478. 2>C:\Program Files (x86)\MSBuild\Microsoft\VisualStudio\v14.0\AppxPackage\Microsoft.AppXPackage.Targets(2382,5): error APPX0107: The certificate specified is not valid for signing. For more information about valid certificates, see http://go.microsoft.com/fwlink/?LinkID=241478. [C:\a\1\s\Source\Applications\MyApp.WindowsUWP\MyApp.csproj] 2>Done Building Project "C:\a\1\s\Source\Applications\MyApp.WindowsUWP\MyApp.csproj" (default targets) -- FAILED. 1>Done Building Project "C:\a\1\s\Source\MyApp.UWP.sln" (default targets) -- FAILED. Build FAILED. "C:\a\1\s\Source\MyApp.UWP.sln" (default target) (1) ->

If I just delete the certificate (as I did in this particular error log), it fails because it can't find it. If I generate the certificate using the manifest editor in VS, and assign it a password, the build server fails because it doesn't know the password. So I can't get it to build whether I provide a temporary test certificate or not.

How are we supposed to run Windows 10 UWP apps through the Visual Studio Team Services build system? This is something that Microsoft has been promoting for a while now so I I assumed this was a thing that could be done. I can't seem to get the UWP project to actually build.

Hypoglycemia

because I didn't need the signing, I simply disabled signing by adding the parameter /p:AppxPackageSigningEnabled=false to the msbuildArgs section in the YAML file. – Kraus

Answer 1

You can generate a certificate without password assigned.

Or add a PowerShell step in your build definition to import the password protected certificate. Following is the powershell script you can use:

$pfxpath = 'myapp_TemporaryKey.pfx'
$password = 'yourpassword'

Add-Type -AssemblyName System.Security
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$cert.Import($pfxpath, $password, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]"PersistKeySet")
$store = new-object system.security.cryptography.X509Certificates.X509Store -argumentlist "MY", CurrentUser
$store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]"ReadWrite")
$store.Add($cert)
$store.Close()

Remember to set the "Working Folder" to the path where your pfx file placed.

Heron

Thank you for this! I really imagined that MSBuild would search the cert store, find the matching hash and get on with it. Apparently not. – Carlcarla

This solution worked perfectly for me. Just need to add a couple of things to do beforehand: As @Michael Mairegger mentioned also, make sure to include the pfx file into the source control checkin. Also set the pfx file property for 'Copy to Output Directory' to something other than None (which is the default) to ensure that the pfx file is copied to the bin folder ready for packaging. – Inflammation

Answer 2

By default .gitignore ignores any *.pfx file. Therefore it is not added to git. I had the same issue, that the build machine does not has the *_StoreKey.pfx file and therefore the build did not succeed.

For me the solution was to install the *_StoreKey.pfx on the build server. Then building the solution on the build server succeeds.

Sophronia

Is it a security risk to add the store key to the source? I mean, when it is an open source-repo it would surely be but for private/closed repositories it shouldn't be an issue, right? – Abbasid

@Abbasid Depends where this private repro is located. Anything remote should be considered as security risk. I, for now use the Secure file feature of TFSO – Sophronia

In my case I have my xx.pfx file in my solution. I am getting The key file may be password protected error... – Snowy

Answer 3

I solved this with the "secure files" feature: https://learn.microsoft.com/en-us/azure/devops/pipelines/library/secure-files?view=vsts

1. In the build pipeline, there's a "library" tab. I added the pfx (that's excluded from source control) as a file there.
2. I then added "download secure file" as a build task (https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/utility/download-secure-file?view=vsts). Note the environment variable in the documentation (currently $env:DOWNLOADSECUREFILE_SECUREFILEPATH)
3. I then added a command line task to move the file to where it was expected. So the command was move %DOWNLOADSECUREFILE_SECUREFILEPATH% FolderOfMyProject

Now it behaves as though the certificate were checked in.

Benitabenites

This is beautiful and by far the best option I could find for a public-facing pipeline. The anonymous build results page doesn't even show the Secure File step. – Thousand

Answer 4

Same issue I met these days, And I finally successfully solved with the help of this post.

Actually we must ensure we had create a test-used .pfx as the developer of UWP ,and followed words shared some helpful solutions I thought:

• Create a test certificate with VS:

  1. In Visual Studio, from Solution Explorer, open Package.appxmanifest
  2. In the App Manifest Designer, choose the Packaging tab, and then choose the Choose Certificate button.
  3. In the Choose Certificate dialog box, expand the Configure Certificate list, and then choose Create test certificate.
  4. In the Create test certificate dialog box, input your info and click the OK button.(Above step description are coming from this ↓)

• Create a certificate with MakeCert,Pvk2Pfx and Certutil tools

  1. MDSN : How to create an app package signing certificate

Hope it can help u!

Ishmul

Answer 5

I too was getting the error:

"Cannot import the key file 'blah.pfx'. The key file may be password protected. To correct this, try to import the certificate manually into the current user’s personal certificate store".

You can double click a .pfx file to import it into your store, the trick is that when it brings up the wizard, you have to choose "Current User", instead of "Local Machine" on the first screen, then instead of "Automatic", I specifically chose "Personal".

I was able to build the package after that. Didn't work when I chose "Local Machine" + Personal.

Trustbuster

Answer 6

Had the same issue (error APPX0107: The certificate specified is not valid for signing) and tryed every solution but nothing worked for me. In fact their was a new line after the key name in the .csproj:

<PackageCertificateKeyFile>myCert.pfx
</PackageCertificateKeyFile>

Removed it and it worked.

Grilled