1

Some of our software services at work offer downloading Excel files as templates to fill in some data and then reuploading them to our software for import. Since the users in our domain usually are not that tech-savy, we used to provide some Excel macros that assist the user in dynamically hiding rows, columns or even whole worksheets.

In the last year Microsoft introduced a new strategy for Office to deal with macros in files (e.g. *.xlsm) that carry the mark of the web (MotW) cause they were downloaded or received by mail. The whole process how Office determines whether to run macros in files with the MotW is documented here. The following flow chart from the article summarizes this process:

Flowchart that shows how Office determines whether to run macros in files from the internet

We learned from this article that in order to run macros in downloaded Excel files like the ones we used to offer our users, they had to be trusted either by file name, location or certificate. While we also consider dropping macros altogether (they still might be disabled completely in certain environments), some people at work now want to sign the macros using a certificate because they think it will solve the problems that users were facing.

In order to test this possibility we successfully signed the macros using a self-signed certificate and temporarily added the root certificate to our computer. However, the problem still exists because the actual certificate used to sign the macros needs to be present in the certificate store for trusted publishers. We can add it there manually or even using Excel and afterwards the whole process works for macros signed with the same certificate, but this registration of the certificate through Excel does not work for files that have the MotW (this behavior is documented here) and that is basically where we are moving in circles. Please don't get me wrong, I can totally understand that this is probably for the users best regarding security.

Now the real question is whether using a certificate with extended validation (EV) will change anything for Excel because this is what someone at my company was told by some certificate vendor. Sadly, we cannot test the workflow with this kind of certificate because as far as I know, there is no way to emulate the behavior of EV certificates.

If I get this whole topic right, EV certificates are not different from regular X.509 certificates, but have a very strict registration process and are based on specific root certificates. These root certificates are hardcoded into certain software like browsers and operating systems, so the software can have additional trust on these certificates, e.g. when it comes to installing software (smart screen) or device drivers (required for Windows 10/11). Regarding Office and Excel I found many vendors claiming that EV certificates may be used to sign macros (since there is no technical difference to non EV certificates), but I could not find a single hint or evidence that there is any benefit in buying and using such a certificate only for signing Excel macros.

Is there a similar functionality regarding Office or Excel? Are macros signed with EV certificates automatically trusted, even for files with the mark of the web? Is there any (other) benefit in signing Excel macros with EV certificates?

7
  • Why do you think you need EV? I don't know much about MS macros, but from your writeup I have the impression that all you need is a certificate issued by a trusted authority.
    – gronostaj
    Mar 9, 2023 at 9:23
  • I think as well that you should not use a self-signed certificate. I don't believe that an EV one will change much, but it's easy to test and doesn't cost a fortune. I hope that the website is in a trusted zone: Mark of the Web and zones.
    – harrymc
    Mar 9, 2023 at 12:29
  • Well, the question is, whether the workflow "random new user comes to website, downloads and opens our Excel file and runs the macros just from inside Excel (e.g. by trusting our certificate, but without removing MotW using Explorer)" would work if the macros are signed using an EV certificate, because that is what some vendor told a colleague of mine. I really doubt this specific benefit of EV certificates (and even any benefit regarding Excel macros) which is why I asked this question. Mar 10, 2023 at 1:53
  • @harrymc When you say "it's easy to test" do you mean that we should just buy an EV certificate or do you know any other way? Mar 10, 2023 at 1:59
  • Buying is the only way, although I doubt seriously that this will help in anything. More seriously: Are the concerned websites included in trusted zones?
    – harrymc
    Mar 10, 2023 at 9:33

1 Answer 1

1

This answer only covers the question of the benefits of using EV certificates. The problem of your downloaded files being marked with the Mark of the Web (MotW) is separate and perhaps related to whether your websites are correctly included in a trusted zone.

From Wikipedia Extended Validation Certificate (EV) :

An Extended Validation Certificate (EV) is a certificate conforming to X.509 that proves the legal entity of the owner and is signed by a certificate authority key that can issue EV certificates. EV certificates can be used in the same manner as any other X.509 certificates, including securing web communications with HTTPS and signing software and documents. Unlike domain-validated certificates and organization-validation certificates, EV certificates can be issued only by a subset of certificate authorities (CAs) and require verification of the requesting entity's legal identity before certificate issuance.

As of February 2021, all major web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge and Apple Safari) have menus which show the EV status of the certificate and the verified legal identity of EV certificates. Mobile browsers typically display EV certificates the same way they do Domain Validation (DV) and Organization Validation (OV) certificates. Of the ten most popular websites online, none use EV certificates and the trend is away from their usage.

So for signing purposes, an EV certificate has no advantage, except perhaps that its Certificate Authority is well-known and sure to be acknowledged everywhere.

Knowledgeable users might also appreciate knowing that the product is marketed by a serious vendor that uses the best protection, but most users won't notice the difference.

Apart from this, Microsoft to my knowledge does not treat EV certificates differently, and products signed with them will not escape from MotW.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .