Fortanix DSM with Signing Microsoft Visual Basic for Applications (VBA) Projects

1.0 Introduction

This article describes how to sign Microsoft Visual Basic for Applications (VBA) projects using Fortanix-Data-Security-Manager (DSM).

Microsoft VBA is available across Microsoft 365 and Microsoft Office desktop applications, including Excel, Outlook, PowerPoint, and Word. VBA extends application functionality and automates repetitive tasks.

VBA macros execute code within the Microsoft Office application that hosts the VBA project. Unsigned VBA projects can therefore introduce security risks. Signing a VBA project with a private key stored in Fortanix DSM helps protect code integrity and support compliance requirements.

2.0 Prerequisites

Ensure the following:

Install the Fortanix CNG provider on the server or workstation used to create the VBA projects. For information on installing and configuring the CNG provider, refer to CNG/EKM.
After installing the provider, run the following command to verify that Windows registered it correctly:
```
certutil -csplist -csp "Fortanix KMS CNG Provider"
```
Figure 1: certutil output
NOTE
If you use a 32-bit Windows machine, install the 32-bit Fortanix CNG Provider and run the command from a 32-bit command prompt.
In the Windows registry, add a DWORD value named V1HashEnhanced under HKCU\SOFTWARE\Microsoft\VBA\Security to specify the hash algorithm. Set the value as follows:
- 1 for SHA-1
- 2 for SHA-256
- 3 for SHA-384
- 4 for SHA-512
NOTE
The default value uses MD5, which is a legacy algorithm that the Fortanix CNG Provider does not support.
Figure 2: V1HashEnhanced registry value set to 2 (SHA-256)

3.0 Product Tested Version

The following product versions were tested:

Fortanix KMS CNG Provider 5.10.2980
Fortanix DSM 5.10 version

4.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

4.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, https://amer.smartkey.io. On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed here based on the application region.

For more information on how to set up the Fortanix DSM, refer to Sign Up for Fortanix Data Security Manager SaaS.

4.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

A screenshot of a login screen AI-generated content may be incorrect. — **Figure 3: Loggin In**

For more information on how to set up an account in Fortanix DSM, refer to Getting Started with Fortanix Data Security Manager - UI.

4.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

In the DSM left navigation panel, click the Groups menu item, and then click ADD GROUP to create a new group.
Figure 4: Add Groups
On the Adding new group page:
1. Title: Enter a name for your group.
2. Description (optional): Enter a short description of the group.
Click SAVE to create a new group.

The new group is added to the Fortanix DSM successfully.

For more information about groups, refer to Definitions.

TIP
It is recommended to configure a Key undo policy for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured Key undo policy, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. For detailed steps, refer to Key Undo Policy.

4.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

In the DSM left navigation panel, click the Apps menu item, and then click ADD APP to create a new app.
Figure 5: Add Application
On the Adding new app page:
1. App name: Enter the name for your application.
2. ADD DESCRIPTION (optional): Enter a short description of the application.
3. Authentication method: Select the default API Key as the authentication method from the drop down menu. For more information on these authentication methods, refer to Authentication.
4. Assigning the new app to groups: Select the group created in Section 4.3: Creating a Group from the list.
Click SAVE to add the new application.

For more information about applications, refer to Definitions.

4.5 Copying the API Key

Perform the following steps to copy the API key from the Fortanix DSM:

In the DSM left navigation panel, click the Apps menu item, and then click the app created in Section 4.4: Creating an Application to go to the detailed view of the app.
On the INFO tab, click VIEW API KEY DETAILS.
From the API Key Details dialog box, copy the API Key of the app to use in Section 5.0: Configure the Fortanix KMS CNG Provider.

5.0 Configure the Fortanix KMS CNG Provider

Configure the Fortanix KMS CNG Provider on the signing workstation with the required configuration variables. For information on configuring the Fortanix KMS CNG Provider, including API key-based and certificate-based authentication, refer to Microsoft CNG Key Storage Provider.

6.0 Creating the Private Key and Certificate

Create a self-signed or CA-signed certificate for signing the VBA project. The associated private key is securely stored in Fortanix DSM.

5.1 Creating a Self-Signed Certificate

Perform the following steps to create a self-signed certificate and corresponding private key in Fortanix DSM:

Run the following PowerShell command to generate the private key and a self-signed certificate in Fortanix DSM:
```
$cert = New-SelfSignedCertificate -Subject "VBASignCert" -type codesigningcert -provider "Fortanix KMS CNG Provider" -certstorelocation Cert:\CurrentUser\My
```
This command creates the certificate and stores it in the Current User certificate store.
Run the following command to verify that the certificate is available in the certificate store:
```
certutil -store -user My
```
Figure 6: Verifying the certificate
This command creates the corresponding private key in Fortanix DSM.
Figure 7: Key created in Fortanix DSM

6.2 Creating a CA-Signed Certificate

Perform the following steps to generate a certificate signing request (CSR) by using certreq.exe and submit the CSR to your certificate authority (CA) for signing:

In a temporary directory, create a file named request.inf.
Add the following configuration to the file and update the placeholders as required:
```
[NewRequest]
Subject = "CN=<Common_Name>,OU=<Organizational_Unit>,O=<Organization>,C=<Country>"
KeyContainer = "<Key_Container>"
ProviderName = "Fortanix KMS CNG Provider"
```
Where,
- Common_Name: The common name for the certificate.
- Organizational_Unit: The organizational unit for the certificate.
- Organization: The organization name.
- Country: The two-letter country code.
- Key_Container: The name of the key created in Fortanix DSM.
Run the following command to generate the CSR:
```
certreq.exe -new request.inf request.csr
```
Submit the CSR to your CA for signing.
After you receive the signed certificate, install it in the Current User certificate store.

7.0 Sign a VBA Project in Outlook

Perform the following steps to sign a VBA project in Classic Outlook:

Open Classic Outlook and navigate to Developer → Visual Basic. Create an .OTM file.
Figure 8: Creating the .OTM file
In the Microsoft Visual Basic window, navigate to Tools → Digital Signature.
Click Choose.., select the VBA signing certificate, and click OK.
Figure 9: Selecting the VBA signing certificate
Save the .OTM file.

The Fortanix DSM Audit Log shows the application authentication and signing operation

NOTE
You can follow similar steps to sign VBA macros in other Microsoft Office applications, such as Excel, Word, and PowerPoint.

8.0 Troubleshooting

If you encounter issues while signing a VBA project, check the logs in the user's %APPDATA% folder.