Code Signing certificate for Azure Key Vault

Sign EXE, DLL, MSIX, PowerShell and NuGet packages directly from Azure Key Vault. No USB token needed. AzureSignTool replaces signtool.exe and authenticates to your Key Vault, where your private key is stored on a FIPS 140-2 Level 3 HSM. The key never leaves the HSM.

Azure Key Vault Premium costs approximately $5/month with near-unlimited signings. That is dramatically cheaper than CA-hosted cloud signing services like DigiCert KeyLocker (~$300/year + signing limits on top of the certificate).

Buy Code Signing for Azure Key Vault ↓ Compare all key storage options →

What is Azure Key Vault Code Signing?

Azure Key Vault is Microsoft's cloud-based key management service. In the Premium tier, keys are stored on FIPS 140-2 Level 3 certified HSM hardware. The private key is generated inside the HSM and never leaves it. All signing operations happen on the HSM itself.

AzureSignTool ↗ is a free, open-source drop-in replacement for signtool.exe that authenticates to Azure Key Vault using a service principal or managed identity. It supports Authenticode signing for all standard Windows file types.

Since June 2023, all Code Signing certificates (OV and EV) require HSM-backed key storage. Azure Key Vault meets this requirement. Software-only .pfx files are no longer permitted by any Certificate Authority.

OV vs EV Code Signing with Azure Key Vault

	OV Code Signing	EV Code Signing
Validation	Organisation	Extended (stricter)
SmartScreen reputation	Builds over time with downloads	Builds over time with downloads, same as OV
Kernel-mode driver signing	No	Yes (required by Microsoft)
Azure Key Vault	Premium tier (RSA-HSM keys)	Premium tier (RSA-HSM keys)
Issuance time	GlobalSign usually the same working day, DigiCert usually 2-3 working days	GlobalSign usually one working day more than OV, DigiCert usually 2-3 working days
Maximum validity	460 days	460 days

Issuance times are typical, not guaranteed. They assume we can reach you easily and that you return the signed documents right away.

Azure Trusted Signing vs your own certificate

Microsoft offers Azure Trusted Signing at ~$10/month as an alternative. It handles the certificate for you. Here is why using your own certificate in Azure Key Vault is usually the better choice:

Your own certificate (Azure Key Vault)

✓ Portable: not locked to Azure
✓ Works with any signing tool (AzureSignTool, Jsign, signtool)
✓ You own the certificate and the identity
✓ Required for some enterprise and government workflows
✓ Choose your CA (DigiCert or GlobalSign)
✓ No monthly subscription for the certificate itself

Azure Trusted Signing

✓ Managed by Microsoft, simpler setup
✓ ~$10/month subscription
— Locked to Azure ecosystem
— Microsoft controls the certificate identity
— Not accepted in all enterprise environments

Compatible Certificate Authorities

Only DigiCert and GlobalSign Code Signing certificates work with Azure Key Vault. Sectigo/Comodo certificates are not compatible because Azure Key Vault does not support their key attestation format.

FairSSL sells both DigiCert and GlobalSign Code Signing certificates and provides installation guides for both CAs with Azure Key Vault. We recommend the CA that best fits your requirements and budget.

File types you can sign with Azure Key Vault

.exe.dll.msi.msix.cab.ps1 (PowerShell).appx.vsixNuGet packages.sys (drivers, EV only)

For Office macro signing (.xlsm, .docm, .pptm), see our Office macro signing guide (requires 32-bit signing tools).

Quick setup overview

Buy a Code Signing certificate from FairSSL

Choose DigiCert or GlobalSign, OV or EV. Select "Azure Key Vault" as delivery method.

Create Azure Key Vault (Premium tier)

Create an RSA-HSM 4096-bit key, non-exportable. Premium SKU is required for HSM-backed keys.

Generate CSR from Key Vault

Create a certificate request with Subject CN=Your Company Name, EKU 1.3.6.1.5.5.7.3.3 (Code Signing), Content Type: PEM.

Submit CSR and complete validation

FairSSL handles the organisation validation. At GlobalSign an OV certificate can be issued the same working day, at DigiCert it usually takes 2-3 working days. Both assume we can reach you and that you return the signed documents right away.

Import signed certificate into Key Vault

Merge the CA's response into the pending certificate request in Azure Key Vault.

Install AzureSignTool and sign

dotnet tool install --global AzureSignTool

FairSSL provides complete step-by-step installation guides with screenshots for both DigiCert and GlobalSign after purchase.

Full Azure Key Vault setup guide with CLI commands and CI/CD examples →

Azure DevOps pipeline example

AzureSignTool integrates into Azure DevOps, GitHub Actions and GitLab CI. Here is a minimal Azure Pipelines YAML example:

- task: DotNetCoreCLI@2
  displayName: 'Install AzureSignTool'
  inputs:
    command: 'custom'
    custom: 'tool'
    arguments: 'install --global AzureSignTool'

- script: |
    AzureSignTool sign \
      -kvu $(KeyVaultUrl) \
      -kvc $(CertificateName) \
      -kvt $(TenantId) \
      -kvi $(ClientId) \
      -kvs $(ClientSecret) \
      -fd sha256 \
      -tr http://timestamp.digicert.com \
      -td sha256 \
      "$(Build.ArtifactStagingDirectory)\**\*.exe"
  displayName: 'Sign executables'

Store Key Vault credentials as pipeline variables or use Azure RBAC with a managed identity for keyless authentication. Required Key Vault roles: Key Vault Crypto User, Key Vault Certificate User, Key Vault Secrets User.

Code Signing certificates for Azure Key Vault

OV Code Signing

DigiCert CodeSign OV

DigiCert OV Code Signing. Works with Azure Key Vault.

from €475 €374 /year See details →

GlobalSign CodeSign

GlobalSign OV Code Signing. Works with Azure Key Vault.

from €375 /year See details →

EV Code Signing

DigiCert CodeSign EV

DigiCert EV Code Signing. Azure Key Vault + kernel drivers.

from €700 €440 /year See details →

GlobalSign CodeSign EV

GlobalSign EV Code Signing. Azure Key Vault + extended organisation validation.

from €442 /year See details →

See all products with prices →

Frequently asked questions about Azure Key Vault Code Signing

Find answers to the most common questions about SSL certificates and FairSSL.

Can I use Sectigo or Comodo certificates with Azure Key Vault?

No. Azure Key Vault does not support the key attestation format used by Sectigo and Comodo. Only DigiCert and GlobalSign Code Signing certificates are compatible with Azure Key Vault HSM-backed keys. FairSSL sells both brands.

Do I need Azure Key Vault Premium?

Yes, for code signing you need the Premium SKU. The Standard SKU cannot create RSA-HSM keys (hardware-backed, non-exportable). The Premium tier costs approximately $5/month including 500,000 cryptographic operations.

What is the difference between Azure Key Vault and Azure Trusted Signing?

Azure Trusted Signing (~$10/month) is a separate Microsoft service where Microsoft manages the certificate. With Azure Key Vault, you own and control your own certificate from a CA you choose (DigiCert or GlobalSign). Your certificate is portable, works with any signing tool, and is not locked to Azure infrastructure. Trusted Signing locks you into Microsoft's ecosystem.

Will my signed EXE show a SmartScreen warning?

At first, yes. SmartScreen evaluates the reputation of the file and its publisher, not just whether the signature is valid. Microsoft states that EV certificates no longer give an advantage in SmartScreen, so a new file shows a warning with OV and EV alike until reputation has built up. The key storage method (Key Vault vs USB token) has no effect on SmartScreen reputation.

What happens after the certificate expires?

Code Signing certificates have a maximum validity of 460 days (approximately 15 months), set by the CA/Browser Forum. If you used RFC 3161 timestamping when signing (and you should always do this), your signatures remain valid indefinitely after the certificate expires. You only need to renew when you want to sign new files.

Can I sign from an Azure DevOps pipeline?

Yes. AzureSignTool works in Azure DevOps, GitHub Actions, GitLab CI, and any pipeline that can run a .NET process. You authenticate to Key Vault using a service principal or managed identity. See the pipeline example above.

Can I sign Office macros from Azure Key Vault?

Yes, but Office VBA signing requires the 32-bit version of AzureSignTool or the x86 .NET host. See our Office macro signing guide for the complete setup.

Ready to sign from Azure Key Vault?

A code signing certificate requires your company to be validated, so it is not issued in minutes. We help you choose the certificate and key storage and keep you informed during validation.

See code signing certificates Contact us