Digitally sign a VBA macro

You've built a good tool. Now it has to actually run on someone else's locked-down machine. Corporate Excel is usually configured (in File ▸ Options ▸ Trust Center ▸ Macro Settings) to "Disable all macros except digitally signed macros", or, stricter, "Disable all with notification". An unsigned .xlam on a machine like that is dead on arrival. Its macros are disabled without any message, and your button does nothing. Signing is how you get past the guard.

A digital signature attaches a certificate to the VBA project, along with a cryptographic hash of the code. When the user opens the file, Excel checks the signature. If the certificate belongs to a Trusted Publisher and the hash matches (the code hasn't been altered since signing), the macros run with no prompt. There are two kinds of certificate:

• Self-signed (via SelfCert.exe, shipped with Office): free, instant, and trusted only on the machine that created it. That makes it perfect for your own Personal Macro Workbook, because your own macros stop nagging you. It's useless for distribution, because no one else's Excel trusts your homemade cert.
• CA-issued code-signing certificate: bought from a certificate authority (or issued by your company's internal CA). It chains to a root every machine already trusts, so this is what you sign an .xlam with before rolling it out to a team.

You sign inside the VBE: Tools ▸ Digital Signature ▸ Choose ▸ select the certificate, then save. The first time a user runs the signed add-in, they get a one-time "Trust all documents from this publisher?" prompt. Click yes and the publisher joins their Trusted Publishers list for good.

When do you need a signature, and when is a trusted folder enough?

Two related mechanisms complete the picture. Trusted Locations are folders (like a team share) from which Excel runs macros without any signature at all. That's convenient inside a company, and risky if anyone can write to the folder. And any change to signed code breaks the signature. That's a feature, because it proves the code a user runs is the code you signed. So, for distribution, sign with a real cert or drop the file in an agreed Trusted Location. For yourself, self-sign the Personal Macro Workbook and move on.