Digital / Self-signed certificates, what's the point?

Hi there,

I've built a spreadsheet that I share with people online. Someone asked if I could "digital sign my macros for those who are security conscious and block unsigned macros". Although open to the idea, I must admit I didn't know what he was referring to initially (and I'm still confused about it). I've looked online and it seems that there are two possibilities: a certificate provided by a commercial certificate authority or a self-signed certificate. The first option seems crazy expensive (hundreds of $ every year just to get a signature?) while I'm puzzled by the usefulness of the second. So here are my questions:
- What is the actual point of a digital certificate? How does it make my spreadsheet less risky for my users?
- Do people really spend hundreds of $ every year to get a certificate from a company?
- I've managed to self sign my excel file (VBA project) following an online tutorial but I still don't understand the purpose of it. What's the point of me signing it? Is it just to help users whose excel parameter is on "not execute VBA if unsigned"? Because they can easily go pass that and activate macros anyway, no?
- Is that what my initial user was most likely asking me to do?

Sorry for these basic questions, but reading articles online showed me how to self-sign (or get a certificate from an online provider) but it didn't make its purpose clearer to me.

Thanks

- What is the actual point of a digital certificate? How does it make my spreadsheet less risky for my users?

A digital certificate is a guarantee that you are who you say you are. If you receive a file with a cert from Six String Jazzer then you know it was really sent by Six String Jazzer. However, see next question.

- Do people really spend hundreds of $ every year to get a certificate from a company?

Yes. It is used more by companies than it is by individuals.

A Certificate Authority (CA) is a trusted third party who issues you a certificate after they do identity proofing to be absolutely certain you are who you say you are. I used to work for VeriSign. RSA was the first CA, and VeriSign bought them and went on to become the largest CA. Of course, if you receive a cert from someone, you have to also have trust in the CA.

Certs use the same encryption technology as public key encryption (PKA) but it's kind of inside out. I won't get into it here, but suffice it to say that it is reasonably secure. I am not a security expert but I think you would have to have the resources of a major government to break/fake a cert.

- I've managed to self sign my excel file (VBA project) following an online tutorial but I still don't understand the purpose of it. What's the point of me signing it? Is it just to help users whose excel parameter is on "not execute VBA if unsigned"? Because they can easily go pass that and activate macros anyway, no?

Typically a self-signed certificate is only for testing purposes. It is otherwise useless. It does not verify your identity. It's like you took an index card, wrote your name on it, then tried to use it as ID. IIRC Microsoft Office applications will not trust a self-signed certificate unless it was on the machine where it was generated, so it can be used for testing.

- Is that what my initial user was most likely asking me to do?

Possibly. If so, they don't understand certs. But that's OK because you are doing what they asked. However, as noted above, a self-signed cert may not work.