Add Timestamping - Microsoft Office 2010, 2013, 2016 & 2019

Introduction


By default, when a digital signature is placed in Microsoft Office, the timestamp is based on the local computer's time. Because of this, the digital signature will expire when the Certificate expires. In order to enable long term validity of signatures in Microsoft Office, a valid 3rd party RFC-3161 compliant timestamp must be applied to the signature at the time of signing. Since the timestamp comes from a 3rd party, it can definitively attest to the date & time at which the signature was placed, enabling long term validity. Think of it like a digital notary.


NOTICE: Enabling timestamping in Microsoft Office requires editing the system registry. Editing the registry carries risk if incorrect values are entered. Editing the registry incorrectly may cause system instability and you do so at your own risk. Information in this article is based off of the following Microsoft articles:


Prerequisites

 

  1. Microsoft Office 2010 or 2013
  2. Permission to edit the registry
  3. PersonalSign or AATL Certificate
  4. Timestamping services with GlobalSign


Instructions

 

  1. Go to Start Menu > Run
     
  2. Type regedit and press Enter
     
  3. Navigate to the folder that corresponds to your office version:

    Office 2010:
    HKEY_CURRENT_USER > Software > Microsoft > Office > 14 > Common > Signatures

    Office 2013:
    HKEY_CURRENT_USER > Software > Microsoft > Office > 15 > Common > Signatures

    Office 2016/2019:
    HKEY_CURRENT_USER > Software > Microsoft > Office > 16 > Common > Signatures
     
  4. Right Click the white-space on the right side and choose New DWORD

     
  5. Name it XadESLevel and enter a value of 2:

     
  6. Create another DWORD and this time title it MinXAdESLevel with a value of 1.
     
  7. Finally, right click again and select New String Value and enter the timestamp URL provided by your GlobalSign Account Manager
     
  8. The resulting registry settings should look like this:

     
  9. When you place a signature with office, and look at the signature properties, if it is timestamped by a 3rd party it will be in the XadES-T format:

Related Articles

GlobalSign System Alerts

View recent system alerts.

View Alerts

Certificate Inventory Tool

Please click the button below to log in or sign up.

Log In - Sign Up

SSL Configuration Test

Check your certificate installation for SSL issues and vulnerabilities.