supported key-rollover/"migration option" in Mage.exe when changing code-signing certificate (production blocked)

Summary Our issuing CA (GlobalSign) has advised us that Microsoft ClickOnce supports certificate/key rollover via "Mage.exe or MageUI.exe with the migration option," allowing existing installations to recognize a new signing key. We can find no such option in the mage documentation and need Microsoft to confirm or deny this claim, as our production deployment is blocked on it.

Environment

• FORKPOS, WPF ClickOnce deployment from Our Hosted URL.., thousands of customer devices, auto-update
• Manifests signed with GlobalSign EV Code Signing (RSA-4096, SafeNet 5110+ token); deployment provider URL and application name unchanged
• Production publishing frozen since 2026-08-25

Timeline

1. Signing certificate expired 2026-08-14 (serial 1F8EA770D136DE69A7A0A1CF).
2. Renewal issued 2026-08-25 (serial 48248CE25315CA448D927626) — with a new key pair (containers p11#25af882d8edf4e1 → p11#070feec98416e9a8, differing RSA-4096 moduli).
3. Visual Studio blocks publish: "The application is signed with a different key than the existing application on the server. Do you want to overwrite it?" — we answered No.
4. Test publish to a client produced a full "Application Install — Security Warning" prompt instead of an in-place update.

Claims made by GlobalSign (verbatim, 2026-09-08)

"Microsoft ClickOnce supports key rollover/certificate migration. The updated application can be signed with the new certificate while using Mage.exe or MageUI.exe with the migration option to preserve the legacy publisher identity and allow existing installations to recognize the new signature."

References supplied by GlobalSign:

• learn.microsoft.com/en-us/answers/questions/505723/clickonce-renew-certificate-wpf-desktop-net-4-5-2 — the accepted-path answer here (Hui Liu-MSFT) states customers "have to uninstall and reinstall manually" and lose DataDirectory data, which contradicts the claim above
• learn.microsoft.com/en-us/entra/identity-platform/signing-key-rollover-in-identity-platform — concerns Entra ID token-signing keys, not ClickOnce

Questions

1. Does any supported mechanism exist — in mage.exe/mageui.exe or elsewhere — to migrate an installed ClickOnce base from one signing key to another without uninstall/reinstall? If yes, exact procedure; if no, explicit confirmation so we can plan a migration campaign.
2. Confirm that ClickOnce identity is keyed solely on the manifest-signing public key token, such that same-subject/same-issuer certificates with different keys are different applications.
3. Recommended migration pattern at fleet scale, specifically for preserving ClickOnce user data under AppData\Local\Apps\2.0\Data (identity-keyed) across a forced reinstall.
4. During 2026-08-14 → 2026-08-25 (expired cert), under what conditions (timestamping present/absent, .NET version) do already-deployed manifests fail updates?

Attachments: VS publish warning screenshot; client install-prompt screenshot; SafeNet cert details for both certificates.Summary Our issuing CA (GlobalSign) has advised us that Microsoft ClickOnce supports certificate/key rollover via "Mage.exe or MageUI.exe with the migration option," allowing existing installations to recognize a new signing key. We can find no such option in the mage documentation and need Microsoft to confirm or deny this claim, as our production deployment is blocked on it.

Environment

• FORKPOS, WPF ClickOnce deployment from Our Hosted URL.., thousands of customer devices, auto-update
• Manifests signed with GlobalSign EV Code Signing (RSA-4096, SafeNet 5110+ token); deployment provider URL and application name unchanged
• Production publishing frozen since 2026-08-25

Timeline

1. Signing certificate expired 2026-08-14 (serial 1F8EA770D136DE69A7A0A1CF).
2. Renewal issued 2026-08-25 (serial 48248CE25315CA448D927626) — with a new key pair (containers p11#25af882d8edf4e1 → p11#070feec98416e9a8, differing RSA-4096 moduli).
3. Visual Studio blocks publish: "The application is signed with a different key than the existing application on the server. Do you want to overwrite it?" — we answered No.
4. Test publish to a client produced a full "Application Install — Security Warning" prompt instead of an in-place update.

Claims made by GlobalSign (verbatim, 2026-09-08)

"Microsoft ClickOnce supports key rollover/certificate migration. The updated application can be signed with the new certificate while using Mage.exe or MageUI.exe with the migration option to preserve the legacy publisher identity and allow existing installations to recognize the new signature."

References supplied by GlobalSign:

• learn.microsoft.com/en-us/answers/questions/505723/clickonce-renew-certificate-wpf-desktop-net-4-5-2 — the accepted-path answer here (Hui Liu-MSFT) states customers "have to uninstall and reinstall manually" and lose DataDirectory data, which contradicts the claim above
• learn.microsoft.com/en-us/entra/identity-platform/signing-key-rollover-in-identity-platform — concerns Entra ID token-signing keys, not ClickOnce

Questions

1. Does any supported mechanism exist — in mage.exe/mageui.exe or elsewhere — to migrate an installed ClickOnce base from one signing key to another without uninstall/reinstall? If yes, exact procedure; if no, explicit confirmation so we can plan a migration campaign.
2. Confirm that ClickOnce identity is keyed solely on the manifest-signing public key token, such that same-subject/same-issuer certificates with different keys are different applications.
3. Recommended migration pattern at fleet scale, specifically for preserving ClickOnce user data under AppData\Local\Apps\2.0\Data (identity-keyed) across a forced reinstall.
4. During 2026-08-14 → 2026-08-25 (expired cert), under what conditions (timestamping present/absent, .NET version) do already-deployed manifests fail updates?

Attachments: VS publish warning screenshot; client install-prompt screenshot;