Visual Studio 2022 ClickOnce签名失败：无符合条件证书求助

在Windows 10系统的Visual Studio 2022中对遗留程序进行更新，点击Start按钮构建时出现以下错误：

An error occurred while signing: Failed to sign bin\x86\Debug\app.publish\Data Review Utility.exe. SignTool Error: No certificates were found that met all the given criteria.

已执行以下操作：

• 旧证书过期，创建了无密码的新测试证书
• 确认证书已安装在当前用户的Trusted Root Certification Authorities中
• 证书Thumbprint与.csproj中的值完全匹配
• 尝试过以普通和管理员身份运行Visual Studio
• 证书Intended Purposes设置为All

在Developer PowerShell中执行以下命令可成功签名：

signtool sign /debug /f "C:\LocalFiles\ReportTool\Data_Review_Utility\Data Review Utility.pfx" "C:\LocalFiles\ReportTool\Data_Review_Utility\bin\x86\Debug\app.publish\Data Review Utility.exe"

成功签名的输出如下：

The following certificates were considered:
    Issued to: akirk
    Issued by: akirk
    Expires:   Thu Jun 27 13:21:56 2024
    SHA1 hash: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX1

After EKU filter, 1 certs were left.
After expiry filter, 1 certs were left.
After Private Key filter, 1 certs were left.
The following certificate was selected:
    Issued to: akirk
    Issued by: akirk
    Expires:   Thu Jun 27 13:21:56 2024
    SHA1 hash: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX1


The following additional certificates will be attached:
Done Adding Additional Store
Successfully signed: C:\LocalFiles\ReportTool\Data_Review_Utility\bin\x86\Debug\app.publish\Data Review Utility.exe

Number of files successfully Signed: 1
Number of warnings: 0
Number of errors: 0

但在VS中点击Start按钮仍报错，不想取消Sign the ClickOnce manifests或更改目标框架，请问遗漏了什么配置？

1. 调整ClickOnce签名的证书选择方式
   打开项目属性→发布→签名，确认选择从文件选择证书而非从存储区选择。即使证书已安装，VS构建ClickOnce时可能无法从存储区正确匹配证书，直接指定PFX文件路径更可靠。

2. 手动验证.csproj签名配置
   编辑项目的.csproj文件，确保以下配置项完整且正确：

   <SignManifests>true</SignManifests>
   <ManifestCertificateThumbprint>你的证书SHA1指纹</ManifestCertificateThumbprint>
   <ManifestKeyFile>C:\LocalFiles\ReportTool\Data_Review_Utility\Data Review Utility.pfx</ManifestKeyFile>
   <ManifestPassword></ManifestPassword> <!-- 无密码则留空 -->
   

   若之前通过存储区选择证书，可能缺少ManifestKeyFile和ManifestPassword配置，导致VS构建时无法定位证书文件。

3. 清理项目缓存后重新构建

   • 删除项目根目录下的bin和obj文件夹
   • 在VS中选择生成→清理解决方案
   • 重启VS后重新构建项目
     旧的签名缓存可能干扰新证书的正常使用。

4. 确认证书的增强密钥用法（EKU）
   打开证书管理器，找到目标证书→右键→属性→详细信息→增强密钥用法，确保存在代码签名（OID: 1.3.6.1.5.5.7.3.3）条目。手动创建测试证书时若未指定代码签名EKU，VS的ClickOnce签名流程会过滤该证书。

5. 匹配构建平台与证书兼容性
   确认项目的<PlatformTarget>配置为x86（与构建路径bin\x86\Debug一致），避免因平台不匹配导致证书验证失败。

内容的提问来源于stack exchange，提问作者zynovij