'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Fix Access Pack and Sign SHA1withRSA Certificate Errors
Question details
The user needs to resolve a failure that occurs when signing an Access database package with a DigiCert HSM KeyLocker code-signing certificate.
- Product
- Microsoft Access
- Device & OS
- not provided
- Scenario
- Attempting to sign a Microsoft Access database package using a modern SHA-384 or SHA-512 code-signing certificate.
- Observed behavior
- VBA code signs successfully, but the Access package signing fails because the system incorrectly requests the unsupported and deprecated SHA1withRSA algorithm.
Ensure you have administrative privileges on your computer and a backup of your Access database before attempting to change its file format or update your development signing tools.
Update Your Code Signing Tool to the Latest Version
Use this solution if you are signing the package via command-line tools, as older versions have a known bug that defaults to SHA-1 when encountering non-SHA-256 certificates.
Older versions of signing tools (such as mage.exe or smctl.exe) often contain a bug that defaults the hashing algorithm to 'sha1RSA' if the certificate utilizes anything other than standard SHA-256 (like SHA-384 or SHA-512). Updating the tool ensures correct SHA-2 algorithm compatibility.
Open your development environment (such as Visual Studio 2022) or terminal and check the current version of the signing tool you are using (e.g., mage.exe).
If you use Visual Studio, open the Visual Studio Installer and click 'Update' to install the latest patches, which include an updated version of mage.exe.
Alternatively, open your command prompt and run the 'dotnet tool install' command to manually fetch and install the absolute latest version of your specific signing tool.
Run your signing script or tool again, ensuring you explicitly set the configuration to a supported SHA-256 (or higher) signing parameter if available.
Convert the Database to the Newest Access Format
Use this solution if your Access database is currently saved in an older format (like Access 2007), which natively lacks full SHA-2 support.
Looking for a Lightweight, Hassle-Free Office Suite?
While Microsoft Access database certificate errors require specific developer tool updates, standard document creation shouldn't be complicated. WPS Office is a free, lightweight, and incredibly intuitive alternative to Microsoft Office. It covers all your Word, Excel, and PowerPoint needs without the heavy resource usage.
Frequently Asked Questions
Why does my DigiCert certificate work for VBA but fail for the Access package?
VBA code signing and Access package signing use two different underlying mechanisms. While the VBA signing module properly handles SHA-256 and higher algorithms, the older Access packaging tool or database format may inherently default to the deprecated SHA1withRSA algorithm.
Can I use SHA-384 or SHA-512 certificates to sign an Access 2007 database?
Generally, no. Older database formats like Access 2007 have limited or no support for modern hashing algorithms. When you attempt to sign them with SHA-384 or SHA-512 certificates, the system may mistakenly request SHA-1 instead. You must convert the database to a newer format.
How do I force my command-line signing tool to use SHA-256?
You need to update your signing tool (such as mage.exe) to the newest version. Certain older versions contain a known bug that forces a fallback to SHA-1 if the certificate is not specifically SHA-256 (e.g., if it's SHA-384). Updating via Visual Studio or the dotnet CLI resolves this.
What is DigiCert HSM KeyLocker?
DigiCert HSM KeyLocker is a cloud-based code signing solution that secures your private cryptographic keys in a remote Hardware Security Module (HSM). This allows you to sign code, macros, and packages securely without needing a physical USB token.
