2 Replies Latest reply: Oct 28, 2010 9:57 AM by cmegumiburke RSS

    Packaging the CS5 plug-in using Extension Manager.

    cmegumiburke Community Member

      I am trying to package up the *.pln file and the resource files into a single *.zxp file that we can give to customers.  I have been successful in this.  However, when Extension Manager installs the plug-in, it displays a warning that our extension is not signed.  This doesn't affect installation, which is otherwise successful if the user clicks to install anyway, but it would be nice to get the plug-in signed so that the warning doesn't appear.  So, my question is (and I feel silly for having to ask this): how do I sign our plug-in?  I downloaded Creative Suite's signing toolkit and I read the documentation and I see how to package everything up with the command:

       

      java -jar ucf.jar -package -storetype PKCS12 -keystore myCert.pfx -storepass mypasswd myExtension.zxp -C "./myExtension" .

       

      Where do I get pfx files?  Do I buy a certificate from VeriSign (or comparable CA) and generate the *.pfx from the *.cer they will give me?  What kind of certificate do I buy?  Do I ask for an Authenticode certificate?  Will that also work for our Mac plug-in?  Do I need to buy one certificate for Windows and one certificate for Apple?  Am I signing the plug-in itself, or just the *.zxp file?  Do I need to sign the plug-in AND package the signatures together in the *.zxp?  Are these questions I should be asking VeriSign (or other CA)?  Or is it best to just tell the customer that because they're getting our plug-in from us directly, they can just ignore any signature warnings?

       

      I HAVE been on Google all day, but there is a ton of information out there concerning certificates (and most of it about SSL), so if someone wants to simply point me to a primer that will help me narrow down my questions, I would appreciate that too.