Need help with ClickOnce deployment on .NET Framework 4.7.2 – "Unidentified program" warning

Hi,

The short answer is that Windows and antivirus software will never trust a self-signed certificate out of the box, no matter if it is SHA256 V3. To them, a self-signed cert is just you vouching for yourself, which is why SmartScreen and your AV are blocking it.

If this is just for an internal lab or machines you control, you can bypass this for free. Export your .cer certificate from Visual Studio, copy it to the client machines, and install it into both Trusted Root Certification Authorities and Trusted Publishers (make sure to select Local Machine during install).

If you are distributing this to the public, you have no choice but to buy a commercial Code Signing Certificate from a trusted authority.

Also, make sure the "Publisher name" in your Visual Studio publish settings matches the name on your certificate exactly, otherwise ClickOnce will still throw the unidentified warning anyway