Digital Certificates 2

[JoeAtWork]

For the first time, one of my clients is asking that the Macro security warning not be displayed when they open up their database.

It seems unprofessional to tell them to set their security to Low, so I have been looking into getting a code signing certificate. I was wondering if any of you have experience with this. My questions are:

1. Is there a way to create/obtain a certificate other than purchasing one through a Certificate Authority (like Verisign)? I know about SelfCert.exe, but that only works on my computer when I am logged in under the account where I created the certificate.

2. If I purchase a 1-year certificate from a CA, will my clients begin to see warning prompts once the certificate expires? If they see a warning prompt for an expired certificate, can they set it to "always trust" so that they see it only once?

3. What information do I need to submit to the CA if I want a certificate for an individual (myself)? From what I've seen on the Thawte and Verisign sites, they want a domain name, which I currently don't have. Will I need to register a domain before I can apply for a certificate?

 

[oharab]

Joe,
THe instructions at

http://www.source-code.biz/snippets/vbasic/3.htm

will give you a certificate your clients can install on their local machines, which will recognise your signed macros.

It's not as nice as having a flashy verisign one, but a damn sight cheaper!

hth

Ben

----------------------------------------------
Ben O'Hara

http://www.RobotParade.co.uk

We could be confused in exactly the same way, but confusion might be like Nulls, and not comparable.

 

[JoeAtWork]

Thankyou oharab,

After I ran the MakeCert program I was scratching my head as to what the next step should be. Luckily I trust my gut instinct nowadays more than I used to, and was able to figure it out. For other noobs like me, here are the steps:

1. Run following to create certificate on the development computer:
makecert -r -pe -n "CN=MyName" -b 01/01/2000 -e 01/01/2099 -eku 1.3.6.1.5.5.7.3.3 -ss My

2. Go into your VBA project, sign your project with the "MyName" certificate
3. Go into the Digital Signature dialog again (from the Tools menu), click the Detail button
4. Go to Details tab, click the "Copy to File..." button
5. Choose all the defaults in the wizard and create the CER file
6. Copy the CER file to the target computer
7. On the target computer, right-click CER file. From the context menu, choose "Install Certificate"
8. Go through the wizard. On "Finish" you will be prompted with one final Yes/No security dialog box.
9. Open the MDB file on the target computer
10. On the security warning, checkmark the "Always trust files from this publisher and open automatically" checkbox
11. From now on, when that user opens the database, he will no longer get the macro security warning.
He also won't get the warning for other VBA projects signed with that certificate.

 

[JoeAtWork]

I have a followup question. I wanted to create a certificate that could apply to the local machine rather than the user, so that each user doesn't have to go through the process of installing the certificate and then trusting it.

I tried this:

makecert -r -pe -n "CN=MyName2" -b 01/01/2000 -e 01/01/2099 -eku 1.3.6.1.5.5.7.3.3 -ss My -sr localmachine

but I don't see the MyName2 as an option when I try to sign a VBA project. What am I doing wrong?

 

[ycim]

I am running into the same issue. However, I beleive makecert.exe is only on Vista??? Are the rumors true??

 

[BuilderSpec]

Hi

Glad I found this post as I have been having same problems with my clients too.

Downloaded the program makecert and ran the example.

1) Where does the certificate get saved to ?
2) Running Access XP , how do I attach the Certificate to the database ? Once in VBA side the only options on the Tools menu are :"References" , "Macros","Options" and "Properties"

Any help greatly appreciated.


Hope this helps!

Regards

BuilderSpec

 

[JoeAtWork]

ycim - you can download makecert.exe from Microsoft if you don't already have it

BuilderSpec - to anwer your questions
1. I don't know where the certificate gets "saved" - it just becomes available as an option on my Digital Certificates dialog box
2. In Access 2003 I see Digital Certificates on the Tools menu right below Properties. Perhaps it is a custom install option and you need to run Office setup? Or maybe it's part of a service pack? (I have SP 2)