I have been selling an AIR application for four months now. Often people complain that they can't install it because of a warning that the "publisher is unknown", or there is no verifiable digital signature.
Today I went to Thawte and paid $299 for a one-year code signing certificate.
My first question is, can I simply point the AIR application to the new certificate, or will there be a conflict due to the self-signed certificate that I have used for this application previously?
My second question is, after I attach my Thawte digital certificate and publish the application, what happens if I need to make an update to the program and republish? Often a user will inform me of a minor bug in version 1.0 which I can easily fix. When I publish version 1.1 corrected of bugs, will I be able to use the certificate again?
You need to use the certificate migration feature to migrate your older versions of the applications to newer ones signed by new certificate.
This document explains this process: