Knowledge Base

Overview

By the end of this article, you will understand why Microsoft Excel rejects a Visual Basic for Applications (VBA) macro signature made with a code signing certificate stored on a SafeNet token, and you will have applied the registry change that allows the signing to complete. The cause is a mismatch between the hash algorithm Excel uses for macro signing and the algorithms the token permits by default. The article gives the error as it appears, explains the root cause, sets out the registry change that resolves it, and covers verifying the fix and reversing it if needed.

Read the security note before applying this change. The fix re-enables a deprecated cryptographic algorithm on the computer, and that has implications beyond Excel.

The Error

When signing a VBA macro in Microsoft Excel using a code signing certificate installed on a SafeNet token, the signing fails with:

There was a problem with the digital certificate. The VBA project could not be signed. The signature will be discarded.

 
Figure 1: Excel digital certificate error stating the VBA project could not be signed

Root Cause

Microsoft Excel's VBA signing process applies Message Digest 5 (MD5) hash padding as part of one of its triple-signing steps, to maintain compatibility with older versions of Office.

MD5 is a deprecated algorithm. SafeNet tokens block deprecated algorithms by default, because the certificate and key material on the token use modern, stronger algorithms. The token therefore refuses the operation Excel is asking it to perform, and Excel reports the signature as invalid.

The certificate itself is not faulty, and nothing is wrong with the key material on the token. The failure is a policy mismatch between what Excel requests and what the token allows.

Security Note Before You Proceed

The fix works by allowing the token to use deprecated cryptographic algorithms. Before applying it:

• The change applies to the whole computer, not only to Excel. Any application using the SafeNet client on that machine is affected.
• MD5 is deprecated because it is no longer considered collision-resistant. Re-enabling deprecated algorithms weakens the machine's cryptographic posture.
• Apply this only on a machine where you need to sign Office macros, and follow your organisation's change process if one applies.
• The change is reversible. See Reversing the Change below.

Before You Begin

• Administrator rights on the computer. The change is made under HKEY_LOCAL_MACHINE, which standard user accounts cannot modify.
• The SafeNet Authentication Client installed, with your token connected.
• The ability to restart the computer, which is required for the change to take effect.
• A registry backup, or a system restore point, taken before you start.

Apply the Registry Change

1. Open the Windows Registry Editor: select Run, enter regedit, and confirm the administrator prompt.
2. Navigate to:

   HKEY_LOCAL_MACHINE\SOFTWARE\SafeNet\Authentication\SAC\

3. Right-click the SAC key, create a new key, and name it Crypto.
4. Right-click the Crypto key and add a new String value with:
   • Value name: Disable-Crypto
   • Value data: None
5. Close the Registry Editor and restart the computer. The change does not take effect until the machine has restarted.

Verify the Fix

After the computer restarts, sign the VBA macro again. The fix has worked when:

• The signing completes without the digital certificate error.
• The signature is retained when you save and reopen the file, rather than being discarded.
• The signature appears under the project's digital signature settings in the Visual Basic editor.

If the error persists, confirm the Crypto key and its value are present at the path above, and that the computer has been restarted since the change was made.

Reversing the Change

To restore the default behaviour, open the Registry Editor, navigate to the same path, delete the Crypto key you created, and restart the computer. Macro signing will fail with the original error again, so reverse the change only when you no longer need to sign macros on that machine.

Similar Questions

• Why does it say, "The VBA project could not be signed"?
• How do I sign a macro with a certificate on a SafeNet token?
• Why does my code signing certificate fail for VBA macros but work elsewhere?
• What causes a digital certificate error when signing Office macros?

Reference

SafeNet knowledge base article KB0024651

How to Apply a Digital Signature to a VBA Project in Microsoft Office? | Sectigo® Official