How to sign a VBA program?

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Lüko Willms - 13 Dec 2006 12:35 GMT

In order to save the users from answering the question if they want
to accept Macros for this current document, or if they want to live in
the fear of rogue macros, I would like to sign my VBA programs, so
that they can decide to trust my macros always and forever.

How do I do that? I found nothing in the online-help.

Yours,
L.W.

Reply to this Message

Greg Maxey - 13 Dec 2006 12:54 GMT

L.W.

I don't know how exactly, but look up "Digital Signature" in Word Help
(Not VBA help) and it may give you the information that you need.

L?ko Willms wrote:

> In order to save the users from answering the question if they want
> to accept Macros for this current document, or if they want to live in
[quoted text clipped - 5 lines]
> Yours,
> L.W.

Reply to this Message

Tobias Schröer - 13 Dec 2006 15:47 GMT

Hi,

Lüko Willms schrieb:

> In order to save the users from answering the question if they want
> to accept Macros for this current document, or if they want to live in
[quoted text clipped - 5 lines]
> Yours,
> L.W.

hehe, you've found my favourite topic in VBA programming ;)
I nearly smahed my computer when I evaluated this.

In order to sign your VBA code you need a digital certificate. You can
obtain this from a certification center or create your own, using the
SelfCert tool that comes along with MS Office. However, the later works
perfectly fine, but is suggested for development and testing purposed
only. Anyway, I use the self created certificate.

Once you created a digital certificate it is available on the local
computer for code signature. In the VBA Editor, choose "Extras" and
"Digital Signature" (don't know if these are the correct located strings
for english, I use the German language version). Now you can choose a
certificate for signature. Teh code will be signed everytime you change
and save it.
Be aware, that you need the certificate on the computer, if you change
the code!

When the users open a signed document, they must install and trust the
certificate. Then they can select to always trust that certificate and
won't be bothered with the security warning any more.
The certificates can be used for any Office application in the same way.

Sadly, I cannot find the links to the online resoures I used :(

HTH,
Tobi

Reply to this Message

Jay Freedman - 13 Dec 2006 17:18 GMT

>Hi,
>
[quoted text clipped - 36 lines]
>HTH,
>Tobi

Just some additional information:

In English versions of Office, the menu choice is Tools > Digital
Signature.

An article about signing code is at
http://support.microsoft.com/kb/206637.

If you don't work for a company that has installed a certificate
server, and if SelfCert isn't good enough (for example, if you're
selling your work), you have to get a certificate from a Certificate
Authority. The article mentions the companies Verisign and Thawte (see
http://www.verisign.com/products-services/security-services/code-signing/digital
-ids-code-signing/index.html
and
http://www.thawte.com/ssl-digital-certificates/code-signing/index.html,
respectively). What it doesn't mention is the cost: approximately
US$200 per year for Thawte and US$450 to 500 for Verisign. You have to
sell a lot of macros to cover that. :-(

--
Regards,
Jay Freedman
Microsoft Word MVP FAQ: http://word.mvps.org
Email cannot be acknowledged; please post all follow-ups to the
newsgroup so all may benefit.

Reply to this Message

Tobias Schröer - 14 Dec 2006 08:35 GMT

Hi,

Jay Freedman schrieb:

> Just some additional information:
>
[quoted text clipped - 3 lines]
> An article about signing code is at
> http://support.microsoft.com/kb/206637.

Thanks :)

> If you don't work for a company that has installed a certificate
> server, and if SelfCert isn't good enough (for example, if you're
> selling your work), you have to get a certificate from a Certificate
> Authority. The article mentions the companies Verisign and Thawte [..]

However, SelfCert will do. It's just that the certificate is not
"officially" trusted. Beside this, the functionality is the same, if I
got it right. For an individual development, I therefore would say you
can use a SelfCert certificate in a payed project.

> What it doesn't mention is the cost: approximately
> US$200 per year for Thawte and US$450 to 500 for Verisign. You have to
> sell a lot of macros to cover that. :-(

That's bad, true. Either your company (or you by yourself) already own
a certificate, or your customer (for individual development) owns a
certificate you can use, or you must buy, or charge your customer.

Tobi

Reply to this Message

Jonathan West - 15 Dec 2006 14:43 GMT

> Hi,
>
[quoted text clipped - 18 lines]
> it right. For an individual development, I therefore would say you can use
> a SelfCert certificate in a payed project.

That is for you and your customer to decide and agree on. The process of
trusting a Selfcert-generated certificate can be a bit more convoluted.

> > What it doesn't mention is the cost: approximately
>> US$200 per year for Thawte and US$450 to 500 for Verisign. You have to
[quoted text clipped - 3 lines]
> certificate, or your customer (for individual development) owns a
> certificate you can use, or you must buy, or charge your customer.

If you do enough to justify it, I think it is a worthwhile cost.

Signature

Regards
Jonathan West - Word MVP
www.intelligentdocuments.co.uk
Please reply to the newsgroup
Keep your VBA code safe, sign the ClassicVB petition www.classicvb.org

Reply to this Message