Possible to get a .cer file to import to trustworthy publishers?

HSeeger-EXT · April 24, 2024

We are trying to make the Zotero Word Add-In available for our students but our security policies do not allow Add-Ins from publishers that are not trustworthy. To make them trustworthy we need to import the certificate. However, we cant find a certificate to import. Doing some research, it should be possible to extract the certificate from the .dotm file, but we dont know how to do that and I couldnt find anything online about that. Could someone provide support on how to get that certificate file?
Thank you very much in advance.

dstillman · April 24, 2024

You can view and export the certificate from the Developer tab in Word after opening the .dotm file:

https://support.microsoft.com/en-us/office/digitally-sign-your-vba-macro-project-956e9cc8-bbf6-4365-8bfa-98505ecd1c01#ID0EDJ

(These are instructions for signing, but you can view the current certificate from the same place.)

HSeeger-EXT · April 24, 2024

Thank you very much, got it!

HSeeger-EXT · April 30, 2024

Hello again, so I have extracted the certificate via the developer tools -> visual basics -> digital signature and sent it via GPO to the client of one student. I can confirm the certfificate is now listed in Word in the trusted publishers. However, the Zotero Add-In does still not appear in Word. Can you confirm this is the correct certificate?
https://s3.amazonaws.com/zotero.org/images/forums/u14150371/yli2huhzf0p4dxyrd48n.png

Under “Add-ins”, make sure that “Require Application Add-ins to be signed by Trusted Publisher” and “Disable all Application Add-ins” are unchecked.

These boxes are checked, thats part of our security policies. As far as I understand, it should work nevertheless, if the certificate is imported to the trusted publishers, right?

dstillman · April 30, 2024

We can't help with the Word configuration, but that's the root certificate, not our certificate. I don't know if that's sufficient to trust the macro, but even if it is, presumably you wouldn't want to trust anything with that root certificate.