installing certificate using vba

Install it into domain trust.

Here's how.

i work for a company that works for the mililtary.  we do not have control over our network or computers.  the reason we are using access for everything is because we are not allowed to do any programming with real languages that would produce .exe files.  we are stuck using vba and access.  we can install cirtificates on our own computers but we cannot do it across the domain because we cannot control the domain, it is controled by the gov

And everybody decides for themselves what publishers and certificates to trust? anybody can get hold of any certificate, but it's which one you trust is what's important.

I would take a look at http://msdn.microsoft.com/en-us/library/aa374863%28VS.85%29.aspx . If I understand your intention correctly, you want Word to install a certificate that would allow itself to run the code it otherwise is not allowed to run. Isn't this hacker's wet dream...

well sort of, but thats not why im doing it.  i have a government id card that expires every year, when it expires, instead of renewing the certificate when i get a new card they give me a whole new certficate which causes all my programs not to work untill i get all the programs back out there with my new cert and everyone trusts that cert.

right now i have a good cert out there with everyone so my code can run.  what i want it to do is install another cirtificate, a long term cirtificate, so that at a later date i can switch to that one and never have to worry about the cirtificate expiring again.

From what I know, program can't install certificate and tell the the system to trust it, just like I said above - it would be major security breach. Only administrator can do this, either local computer admin, or domain admin. But I'm not really an expert in security. Perhaps someone in security-related are will give you better idea, such as in http://www.experts-exchange.com/Security/Operating_Systems_Security/Windows/

I asked moderator to publish this question in that zone.

the program does not necessarily have to make the certificate trusted.  the problem is that if i just use the certificate to digitaly sign the vba, the cirtificate is not valid unless it is in the root store, so the user will not be able to choose trust from this publisher.  everything the application lanches they will have to tell it to run the vba.  

if i can just get the cert installed the the root store, the user can choose to trust all from this publisher and then they only have to do that once.

bump

Perhaps?
http://technet.microsoft.com/en-us/library/cc758128%28WS.10%29.aspx

we are not admins on our domain, net even our computers.  im beginning to think this is impossible without having our admins going to all the computers with a cd because thumb drives cannot be used on gov computers.

bump.  

the code that will be installing the certificate will already be signed by a trusted publisher since my current certificates are trusted by all users.

This is the case when the answer is "you can't do that". The code can't certify itself , neither directly, nor indirectly (such as by certifying its own publisher). Only administrator can.

,hence, accept http:#25592047

correction: accept http:#25591732

The whole approach to possible solution is worng, the asker has to purchase a certificate from e.g. verisign to solve the problem:

http://www.verisign.com/code-signing/content-signing-certificates/microsoft-office-vba/index.html

           
For developers and software publishers of Microsoft Visual Basic® for Applications (VBA) macro projects, code signing reduces error messages and builds trust in your reputation. VeriSign® Code Signing Certificates for Microsoft® Office and VBA authenticate your identity and validate code integrity.            

• Digitally sign Microsoft VBA Macros for Microsoft Office 
• Protect your brand and your reputation with a trusted digital signature 
• Reduce the cost of maintaining code with a free timestamp
   

Or maybe :

http://www.instantssl.com/code-signing/

Ok here's the no you cannot do that clause:

You will not get a 90 years certificate from any well known certification authority.

You can only add a root certificate to each computer that you use to sign your VBA code for e.g. 90 years.

Please see the difference between signed code and root certificate. This are in fact 2 certificates though on different trust levels.

http://en.wikipedia.org/wiki/Root_certificate

Tolomir

The question was very  specific:

Is there a way to install a certificate into the trusted root certificate store folder using vba

and the answer was in http:#25591732:

program can't install certificate and tell the the system to trust it, just like I said above - it would be major security breach. Only administrator can do this, either local computer admin, or domain admin.

This is certainly valuable addition to the KB, no reason to delete it at all.

There's nothing wrong with "the whole approach to the solution" - it's 100% valid question. Wrong would be exactly not to consider this approach and begin with purchasing public certificate for local network.

Installing a root certificate on 150 - 200 computers is more expensive then a few hunders dollars...
Let's assume you need 5 minutes per computer it will take you more than 12 hours minimum.

Tolomir

Is this version Access2007 or Access2003?

The whole point of the Certificate is to confirm that a program can be trusted. So, your certificate used by your VBA is to let the user know that your VBA code is trustworthy. Therefore, your VBA code in can't say 'Trust Me' while I install a certificate that says you can 'Trust Me'. That's like a robber providing his own alibi.

"You can't do that" is the correct answer. Award the points to http:#25591732

All,
I don't have a dog in this fight, but (if this is a U.S. Military domain) the right answer is for the Asker to work with the appropriate IT Department (DOIM, J-6, etc.) in whatever Military unit he is in.

Running unauthorized macros - or installing certificates without proper Domain Administrator level accounts is an absolute violation of the User Agreement for anyone with a DoD user account.

IMO - "You can't do that" is the right answer in more ways than one.

In Access2007, there is a way to bypass this security feature on a directory-by-directory basis.

ok, here is the deal, the program that is installing the certificate is already trusted by all computers.  the problem is that my certificate is only good for like 6months to 1 year and then it changes and i have to go and get eveyone to trust it again.  what i want to do is have the already trusted certificate install another certificate.

talonsblade,
As mentioned above, you need to work with the DOIM at your HQ to get this resolved.
Regardless of the fact that there may be 'work-arounds' to this situation, you are operating on a U.S. Government base and those responsible for the network need to be the ones making these modifications.

@All Experts -
"Experts-Exchange" is currently on the allowed sites list for all U.S. Department of Defense networks. It is not prudent to give advice to bypass security restrictions on these networks/computers.

The Asker does not have the necessary permissions for a reason - he is not a member of the appropriate department.

well, guess it cant be done.  thanks everyone for your input but a verisign for vba is 1200 dollars and i know my company wont pay for that