Sign Excel macro projects with SignTool using KSP library
SignTool is a command-line tool provided by Microsoft as part of the Windows SDK (Software Development Kit). It is used to digitally sign files, including executable files, libraries (DLLs), drivers, installer packages, and other types of files on the Windows operating system.
Follow these instructions to sign directly using SignTool and securely reference your private key stored in DigiCert® KeyLocker. Alternatively, integrate SignTool with Signing Manager Controller (SMCTL) for simplified signing.
Astuce
SignTool does not support all characters in sign commands, review the following:
Supported characters:
@ % ( ) - _ = [ ] { } ;Unsupported characters:
! # $ ^ & + ` '
To avoid errors, remove unsupported characters from file paths before attempting to sign.
Prerequisites
Windows operating system
Download and install officesips (version 16.0.16507.43425)
Download and install Visual C++ 2010
Download and configure DigiCert® KeyLocker clients
Set up macro signing
Once you install all required tools, open a command prompt in Administrator mode. Next, run the commands:
regsvr32.exe <complete path to msosip.dll>
regsvr32.exe <complete path to msosipx.dll>
If successful, you will see a message: “DIIRegister Server in <complete file path> succeeded."
Sign
Use the SignTool present in the path C:\Program Files (x86)\Windows Kits\10\bin\<version>\x86 to sign Excel macros. To sign, use the command:
<Path_to_32_bit_signtool.exe> sign /csp "DigiCert Signing Manager KSP" /kc "KeyAlias" /f certname.crt /v /debug /fd SHA256 macroname.xlsm
Verify signature
To verify a file is signed, use the command:
<Path_to_32_bit_Signtool.exe> verify /pa macroname.xlsm