Some of our software services at work offer downloading Excel files as templates to fill in some data and then reuploading them to our software for import. Since the users in our domain usually are not that tech-savy, we used to provide some Excel macros that assist the user in dynamically hiding rows, columns or even whole worksheets.
In the last year Microsoft introduced a new strategy for Office to deal with macros in files (e.g. *.xlsm
) that carry the mark of the web (MotW) cause they were downloaded or received by mail. The whole process how Office determines whether to run macros in files with the MotW is documented here. The following flow chart from the article summarizes this process:
We learned from this article that in order to run macros in downloaded Excel files like the ones we used to offer our users, they had to be trusted either by file name, location or certificate. While we also consider dropping macros altogether (they still might be disabled completely in certain environments), some people at work now want to sign the macros using a certificate because they think it will solve the problems that users were facing.
In order to test this possibility we successfully signed the macros using a self-signed certificate and temporarily added the root certificate to our computer. However, the problem still exists because the actual certificate used to sign the macros needs to be present in the certificate store for trusted publishers. We can add it there manually or even using Excel and afterwards the whole process works for macros signed with the same certificate, but this registration of the certificate through Excel does not work for files that have the MotW (this behavior is documented here) and that is basically where we are moving in circles. Please don't get me wrong, I can totally understand that this is probably for the users best regarding security.
Now the real question is whether using a certificate with extended validation (EV) will change anything for Excel because this is what someone at my company was told by some certificate vendor. Sadly, we cannot test the workflow with this kind of certificate because as far as I know, there is no way to emulate the behavior of EV certificates.
If I get this whole topic right, EV certificates are not different from regular X.509 certificates, but have a very strict registration process and are based on specific root certificates. These root certificates are hardcoded into certain software like browsers and operating systems, so the software can have additional trust on these certificates, e.g. when it comes to installing software (smart screen) or device drivers (required for Windows 10/11). Regarding Office and Excel I found many vendors claiming that EV certificates may be used to sign macros (since there is no technical difference to non EV certificates), but I could not find a single hint or evidence that there is any benefit in buying and using such a certificate only for signing Excel macros.
Is there a similar functionality regarding Office or Excel? Are macros signed with EV certificates automatically trusted, even for files with the mark of the web? Is there any (other) benefit in signing Excel macros with EV certificates?