1

I'm trying to generate a self-signed code-signing certificate to sign an Excel XLL Add-In, using makecert and pvk2pfx. I've been following the process described in this answer. I understand makecert is deprecated, however I'm on Windows 7 so apparently the recommendation is to continue using this tool.

All goes well with the Root CA and code-signing certificate generation (I think). 

makecert -r -pe -n "CN=My CA" -ss CA -sr CurrentUser ^
         -a sha256 -cy authority -sky signature -sv MyCA.pvk MyCA.cer
certutil -user -addstore Root MyCA.cer

RootCA details: RootCA

makecert -pe -n "CN=My SPC" -a sha256 -cy end ^
         -sky signature ^
         -ic MyCA.cer -iv MyCA.pvk ^
         -sv MySPC.pvk MySPC.cer

Code Signing cert details: CS Cert

I convert the certificate and key into a PFX file

pvk2pfx -pvk MySPC.pvk -spc MySPC.cer -pfx MySPC.pfx -f

And sign my XLL:

signtool sign /v /f MySPC.pfx /t http://timestamp.digicert.com  TestProject-AddIn64-packed.xll

However, when I try to load the Add-In in Excel, it gives me the following warning:

enter image description here

Even though the certificate details seem to be ok when I click the Show signature details button

enter image description here enter image description here

Does anybody have a clue what is going wrong and how I can fix this?

MarkNS
  • 3,811
  • 2
  • 43
  • 60
  • Can you try installing into the "trustedPublisher" store rather than the "root" store? – Govert Nov 29 '17 at 08:11
  • Otherwise try to manually add the certificate to the Office Trusted Publishers list. – Govert Nov 29 '17 at 08:14
  • Hi @Govert thanks for the tip. I removed the RootCA certificate from from the the Trusted Root Certificates section, and added it to Trusted Publishers. This gave me the warning "The CA Root certificate is not trusted because it is not in the the Trusted Root CA store". So, I added it back (it's now in Trusted Root and Trusted Publishers) - and I see it in the Trust Centre-Trusted Publisher list, with status "This certificate is OK". Nevertheless, when I load the Add-In I still get the "invalid and cannot be trusted error". Very weird :/ – MarkNS Nov 29 '17 at 08:35

0 Answers0