Microsoft Authenticode/Office-VBA Code Signing Certificate Guide

Enrollment for Microsoft Authenticode/Office-VBA Code Signing is a fairly simple process unlike Java Code signing. But there are some steps that need to be explained and remembered in order to have a successful enrollment, and certificate pickup.

Microsoft Authenticode/Office-VBA Code Signing is used to Digitally sign 32-bit or 64-bit user-mode (.exe, .cab, .dll, .ocx, .msi, .xpi, and .xap files) and windows kernel-mode software. As well as digitally sign Microsoft Office VBA objects, macros, and third-party applications using VBA.

Here is a list of things to be aware of when enrolling for Microsoft Authenticode/Office-VBA Code Signing:

1. Certificate creation for Microsoft Authenticode/Office-VBA Code Signing is conducted in your browser during enrollment. Depending  on the code signing product you will be advised on the enrollment requires, such as what browser to use.
   Note: When enrolling for a code signing certificate through Acmetek or SSL2048 it is required to use a Firefox Browser for enrollment and pickup of the code signing certificate.
2. The legal information added to the code signing certificate is pulled directly from the information you enter during enrollment.
3. If you would like your code signing certificate to look a certain way you must specify it as such in all the required fields pertaining to Corporate Legal Name or Company fields.
   Example:
   acmetek global solutions inc will not give me the more visually appealing Acmetek Global Solutions, Inc. The enroller must state Acmetek Global Solutions, Inc. in order to get it on the issued certificate.
4. If you have a subdivision that is responsible for this code signing certificate you will have the option to specify it under the Division or OU fields during enrollment.
5. Important: During enrollment you will have the option to list the Technical Contact on the order. The enroller is actually creating the private key pair within their browser. It is important to keep this in mind for the following reasons…
   • Once the certificate gets issued a email will be sent to the Technical Contact with instructions to click on a link in order to pick up their Microsoft code signing product. That link must be Clicked-on/Copy-Pasted into the same System/Browser that was used for the initial enrollment of the code signing certificate.
   • If the enroller – Admin Contact is different than the Technical Contact that email  must be forwarded to the enroller in order to Clicked-on/Copy-Paste the link  into the same System/Browser that was used for the initial enrollment of the code signing certificate.
6. The certificate pickup link must be Click-on/Copy-Paste the link  into the same System/Browser that was used for the initial enrollment of the code signing certificate.
7. Once you get confirmation in your browser that the code signing certificate has been installed you can begin your signing. Depending on how you sign you will have to export your Code Signing Certificate from your browser. Export/backup the code signing certificate and distribute it to your developers is a common practice.
8. For instructions on how to export/backup your code signing certificate click on one of the links below for the corresponding browser you used.
   How to export a certificate from Firefox
   How to export a certificate from Internet Explorer
9. If you are signing office applications or applications using Visual Studio you will need to Export/Import the code signing certificate into your personal user store on the system you are developing on for procedure on how to preform this visit our article How To Import a Code Signing Certificate Into Internet Explorer/Visual Studio.

With your new Microsoft Code Signing certificate you will sign your windows based applications. For actual signing procedures, support and more information on how to code contact Microsoft.