Short: Is there anyway to trust a certificate or publisher, so that the trust remains even after the certificate has expired?
Much longer: We develop (among other things) Excel documents for a number of customers. The documents contain VBA-macros. Before delivering the documents to our customers, we sign the documents with our code signing certificate. The default macro settings in Excel (which all our customers stick to) will prompt the user with a security warning, even if the document is digitally signed. This is a good thing, security wise, but some of our customers' end-users complained. Although they could click "Enable content" to make the code run, they thought it was a bit tiresome to do this many times a day.
About a year ago, we thus started to instruct these customers to configure their computers to trust our certificate (i.e. add the certificate to "Trusted publishers" on their PC:s). I don't know exactly how this was done, but GPO:s were involved. This has the effect that "our" documents are now opened and VBA-code run without warning. Users are happy.
However, our code signing certificate just expired after two years, so we "renewed" it. (This is from DigiCert if it matters). To test the certificate, I just signed a new Excel document with the renewed certificate, uploaded it to one of our customers and tested it. The security warning again appeared. Apparently, this new certificate isn't trusted. It turns out that the "renewed" certificate is actually a brand new certificate, with (as far as I understand) no connection to the previous certificate, the one that has been trusted. So, we now have to tell our customers to again configure their PC:s to trust this certificate. And every two years (it could have been three if we had bought the maximum length) this process has to be repeated.
DigiCert claims this is by nature - there is really no way to get around this. "Renewing" a certificate is actually just another word for "Getting a brand new certificate". It has the same textual name of our company as publisher, but that's it. Is this true? Is there no other way around it, like extending the validity period of an expiring certificate? Or can you trust the certificate somehow differently, so that new certificates from the same "publisher" are all trusted?
Hope I made myself understood...