Code Signing certificate for Office macros
Sign VBA macros in Excel, Word and PowerPoint with a Code Signing certificate. Remove security warnings when users open macro-enabled documents. Distribute signed macros across your organisation via Group Policy.
Both OV and EV Code Signing certificates work for Office macro signing. OV is the obvious choice, since EV provides no additional benefit for VBA signing.
What is Office macro signing?
VBA code signing applies an Authenticode signature to VBA projects in Office documents. When a macro is signed with a certificate that is trusted via Trusted Publishers, Office runs the macro without warnings or prompts.
Signed macros can be trusted via Group Policy without lowering macro security settings. IT administrators add the certificate to the Trusted Publishers store via GPO, and all machines in the domain then trust macros signed with that certificate.
Since June 2023, all Code Signing certificates (OV and EV) require HSM-backed key storage. You can use a USB token, Azure Key Vault, Google Cloud KMS, or AWS CloudHSM.
Supported file types
All macro-enabled Office file types support VBA code signing via Authenticode.
32-bit requirement
Office VBA signing requires 32-bit signing tools. Even on 64-bit Windows, the VBA host uses 32-bit components. Use the correct architecture for your signing tool.
- • AzureSignTool: Install the x86 .NET runtime. Use the 32-bit version of AzureSignTool.
- • signtool.exe: Use the x86 version from the Windows SDK (typically
C:\Program Files (x86)\Windows Kits\10\bin\...\x86\signtool.exe). - • Jsign: Java-based and cross-platform. Works on any architecture without 32-bit requirements.
Self-signed vs CA-issued certificate
Self-signed certificate
- • Free to create
- • No identity validation
- • Must be manually distributed to each machine
- • Not trusted by default
- • Fine for personal use and internal testing
CA-issued certificate (FairSSL)
- ✓ Trusted by Windows out of the box
- ✓ Company name in the signature
- ✓ Deploy once via Group Policy
- ✓ Works across organisations
- ✓ Required for distribution to external parties
Distribution via Group Policy
IT administrators can add the Code Signing certificate to the Trusted Publishers store via GPO. All machines in the domain then trust macros signed with that certificate, without lowering the macro security level.
Sign your VBA macros
Use signtool.exe (x86), AzureSignTool, or Jsign to sign the VBA project.
Export the public certificate
Export the certificate without the private key (.cer file).
Create GPO
Computer Configuration → Windows Settings → Security Settings → Public Key Policies → Trusted Publishers.
Import the certificate
Import the .cer file into Trusted Publishers via GPO. All domain computers now trust signed macros.
Step-by-step guide to signing Office macros
We have a complete guide with commands and screenshots for signing VBA macros with signtool.exe, AzureSignTool, and Jsign.
Read the guide →Related pages: USB Token | Azure Key Vault | Google Cloud KMS | AWS KMS | Office Macros | Compare all →
Code Signing certificates for Office macros
OV Code Signing
DigiCert CodeSign OV
DigiCert OV Code Signing. Works for Office VBA signing.
GlobalSign CodeSign
GlobalSign OV Code Signing. Works for Office VBA signing.
EV Code Signing
Frequently asked questions about Office macro signing
Find answers to the most common questions about SSL certificates and FairSSL.
Ready to sign your Office macros?
Create a free account and issue your first certificate in under 10 minutes.