Code Signing Certificates
Protect your users against counterfeit software. A Code Signing certificate confirms that your software, scripts and applications are genuine and unmodified. It removes the warnings Windows and macOS display when users attempt to install unsigned code.
What is Code Signing?
A digital certificate that signs your code. The signature confirms the publisher and guarantees the code has not been modified.
Used to sign
Benefits
No "Unknown Publisher" warning
Users install with confidence, no security warnings
Verified publisher name
Your company name is displayed in the signature
Tamper protection
Guarantees code has not been modified since signing
Windows SmartScreen
Required for .exe distribution without blocking
OV and EV types
Choose the level that matches your organisation
Code Signing certificate types
OV Code Signing
Organisation Validated
- ✓ Issued to verified organisations
- ✓ Shows company name in the signature
- ✓ Issuance time: 1–3 business days
- ✓ Delivery: USB token, Azure Key Vault or Google Cloud KMS
- ✓ Ideal for: standard software distribution
EV Code Signing
Extended Validation
- ✓ Strictest possible identity verification
- ✓ Higher initial SmartScreen reputation
- ✓ Delivery: USB token, Azure Key Vault or Google Cloud KMS
- ✓ Ideal for: drivers, enterprise software, instant trust
Code Signing certificates
OV Code Signing
DigiCert CodeSign OV
DigiCert OV Code Signing. Broad platform support.
GlobalSign CodeSign
GlobalSign OV Code Signing. Strong brand.
EV Code Signing
SmartScreen, download warnings and reputation
Windows SmartScreen shows warnings based on the publisher's reputation and certificate type. Without a certificate or with low reputation, this warning is shown with the "Run" button hidden:
Windows protected your PC
Microsoft Defender SmartScreen prevented an unrecognised app from starting. Running this app might put your PC at risk.
More info
User must click "More info" to see "Run anyway"
SmartScreen uses four levels of warnings:
Unsigned or unknown publisher
"Windows protected your PC" with only "Don't run". The user must click "More info" to see "Run anyway". This warning also appears for new OV-signed apps with low reputation.
OV Code Signing (new application)
"[Publisher Name] is not commonly downloaded." The publisher's name is shown, but reputation must be built gradually through more downloads.
EV Code Signing
Starts with higher reputation. The warning disappears faster or may not appear at all. Required for Windows kernel-mode driver signing. Since March 2024, Microsoft treats EV more like OV, but reputation still builds faster.
Established reputation
No warning. Once enough users have downloaded and run the software without issues, the warning disappears entirely, regardless of whether the certificate is OV or EV.
Trusted Publishers: To eliminate warnings completely on specific machines, the certificate can be added to the Windows Trusted Publishers certificate store. This is typically done by local IT departments via Group Policy for their own organisation's software or their main suppliers' certificates.
Validity and key requirements
Maximum 459 days validity
The CA/Browser Forum limits Code Signing certificates to a maximum validity of 459 days (approximately 15 months). Multi-year orders are issued with yearly renewals. Timestamped signatures remain valid beyond the certificate's expiry date, so always use timestamping when signing.
Hardware-secured private keys required
Since June 1, 2023, all Code Signing certificates require the private key to be stored on FIPS 140-2 Level 2
(or Common Criteria EAL 4+) certified hardware. Software-only .pfx files are no longer permitted by any CA.
This is an industry-wide requirement, not a policy of any specific CA or reseller.
See our complete guide to key storage options.
How is the signing key stored?
Since June 2023, all Code Signing certificates require the private key on certified hardware. Three options are available:
USB token
Physical SafeNet token, included with the certificate. Shipped next business day, typically received within 2 business days.
Azure Key Vault
Cloud HSM from Microsoft. Ideal for CI/CD pipelines and remote signing. ~$5/month.
Google Cloud KMS
Cloud HSM from Google. Good for organisations already on Google Cloud. ~$2.50/month.
USB token or cloud HSM?
Compare USB token, Azure Key Vault, Google Cloud KMS and AWS KMS. See pricing, advantages and limitations for each option.
Key storage and signing tools
Learn more about each key storage method and the signing tools used to sign your code.
Key storage
USB token
SafeNet crypto device included. FIPS 140-2 Level 2.
Azure Key Vault
Cloud HSM from Microsoft. ~$5/month.
Google Cloud KMS
Cloud HSM from Google. ~$2.50/month.
AWS KMS
Cloud HSM from Amazon. ~$1/month.
Office macros
Sign VBA macros and deploy via Group Policy.
HSM comparison
Compare all key storage options side by side.
Signing tools
SignTool / AzureSignTool
Microsoft's official signing. Windows + Azure Key Vault.
Jsign
Cross-platform. All key stores. Java-based, open source.
Guides
Frequently asked questions about Code Signing
Find answers to the most common questions about SSL certificates and FairSSL.
Ready to sign your software?
Create a free account and issue your first certificate in under 10 minutes.