Code Signing Certificates

Protect your users against counterfeit software. A Code Signing certificate shows your company as the verified publisher and proves the code has not changed since it was signed, but it does not guarantee that warnings disappear: Windows SmartScreen depends on reputation, and macOS requires an Apple Developer ID and notarisation.

GlobalSign

GlobalSign CodeSign

Can be issued the same working day during business hours, if we can reach you right away.

€375/year

excl. VAT

Buy See details →

DigiCert

DigiCert CodeSign OV

Usually issued in 2-3 working days.

€374/year

excl. VAT

Buy See details →

GlobalSign

GlobalSign CodeSign EV

EV usually takes one working day more than GlobalSign OV.

€442/year

excl. VAT

Buy See details →

What is Code Signing?

A digital certificate that signs your code. The signature confirms the publisher and guarantees the code has not been modified.

Used to sign

✓ .exe, .msi, .dll

✓ PowerShell scripts

✓ Office macros

✓ Java/Android apps

✓ Drivers and firmware

✓ macOS apps and .pkg, but Gatekeeper needs Apple's Developer ID

Benefits

No "Unknown Publisher" warning

UAC shows "Verified publisher" with your company name

Verified publisher name

Your company name is displayed in the signature

Tamper protection

Guarantees code has not been modified since signing

Windows SmartScreen

Reputation can build on the certificate and carry over to new versions

OV and EV types

Choose the level that matches your organisation

Code Signing certificate types

OV Code Signing

Organisation Validated

From €374 USB token included

✓ Issued to verified organisations
✓ Shows company name in the signature
✓ Issuance time: GlobalSign usually the same working day, DigiCert usually 2-3 working days
✓ Delivery: USB token, Azure Key Vault or Google Cloud KMS
✓ Ideal for: standard software distribution

EV Code Signing

Extended Validation

From €440 USB token included

✓ Strictest possible identity verification
✓ Required for Windows kernel-mode drivers
✓ Issuance time: GlobalSign usually one working day more than OV, DigiCert usually 2-3 working days
✓ Delivery: USB token, Azure Key Vault or Google Cloud KMS
✓ Ideal for: drivers and enterprise software

Not sure whether OV or EV fits? EV requires extended identity verification of the company. At GlobalSign that usually takes one working day more than OV, at DigiCert both OV and EV usually take 2-3 working days. These times assume we can reach you and that you return the signed documents right away. Call or write, and we will work out what your release needs.

Code Signing certificates

OV Code Signing

DigiCert CodeSign OV

DigiCert OV Code Signing. Broad platform support.

from €475 €374 /year See details →

GlobalSign CodeSign

GlobalSign OV Code Signing. Strong brand.

from €375 /year See details →

EV Code Signing

DigiCert CodeSign EV

DigiCert EV Code Signing. Required for kernel-mode drivers.

from €700 €440 /year See details →

GlobalSign CodeSign EV

GlobalSign EV Code Signing. Hardware key included.

from €442 /year See details →

See all products with prices →

SmartScreen, download warnings and reputation

Windows SmartScreen shows warnings based on the publisher's reputation and certificate type. Without a certificate or with low reputation, this warning is shown with the "Run" button hidden:

Windows protected your PC

Microsoft Defender SmartScreen prevented an unrecognised app from starting. Running this app might put your PC at risk.

More info

Don't run

User must click "More info" to see "Run anyway"

SmartScreen uses four levels of warnings:

Unsigned or unknown publisher

"Windows protected your PC" with only "Don't run". The user must click "More info" to see "Run anyway". This warning also appears for new signed apps with low reputation, whether OV or EV.

OV Code Signing (new application)

"[Publisher Name] is not commonly downloaded." The publisher's name is shown, but reputation must be built gradually through more downloads.

EV Code Signing (new application)

Same as OV. Microsoft states that EV certificates no longer bypass SmartScreen and have no effect on the warning. EV is still required for Windows kernel-mode driver signing.

Established reputation

No warning. Once enough users have downloaded and run the software without issues, the warning disappears entirely, regardless of whether the certificate is OV or EV.

Trusted Publishers: IT departments can add the certificate to the Windows Trusted Publishers store via Group Policy, typically for their own organisation's software or their main suppliers' certificates. Machines they manage then trust it for PowerShell scripts under AllSigned and for signed Office macros; Microsoft does not document it as a way around SmartScreen.

Validity and key requirements

Maximum 460 days validity

The CA/Browser Forum limits Code Signing certificates to a maximum validity of 460 days (approximately 15 months). Multi-year orders are issued with yearly renewals. Timestamped signatures remain valid beyond the certificate's expiry date, so always use timestamping when signing.

Hardware-secured private keys required

Since June 1, 2023, all Code Signing certificates require the private key to be stored on FIPS 140-2 Level 2 (or Common Criteria EAL 4+) certified hardware. Software-only .pfx files are no longer permitted by any CA. This is an industry-wide requirement, not a policy of any specific CA or reseller. See our complete guide to key storage options.

How is the signing key stored?

Since June 2023, all Code Signing certificates require the private key on certified hardware. Three options are available:

USB token

Physical hardware token, included with the certificate. GlobalSign ships its own token, usually arriving within about a week. For DigiCert, FairSSL ships the token with PostNord for next-business-day delivery, usually received within 2 working days.

Azure Key Vault

Cloud HSM from Microsoft. Ideal for CI/CD pipelines and remote signing. ~$5/month.

Google Cloud KMS

Cloud HSM from Google. Good for organisations already on Google Cloud. ~$2.50/month.

USB token or cloud HSM?

Compare USB token, Azure Key Vault, Google Cloud KMS and AWS KMS. See pricing, advantages and limitations for each option.

Compare all options →

Key storage and signing tools

Learn more about each key storage method and the signing tools used to sign your code.

Key storage

USB token

SafeNet crypto device included. FIPS 140-2 Level 2.

Azure Key Vault

Cloud HSM from Microsoft. ~$5/month.

Google Cloud KMS

Cloud HSM from Google. ~$2.50/month.

AWS KMS

Cloud HSM from Amazon. ~$1/month.

Office macros

Sign VBA macros and deploy via Group Policy.

HSM comparison

Compare all key storage options side by side.

Signing tools

SignTool / AzureSignTool

Microsoft's official signing. Windows + Azure Key Vault.

Jsign

Cross-platform. All key stores. Java-based, open source.

Guides

→ Azure Key Vault setup → Google Cloud KMS setup → AWS KMS setup → Office macro signing → GlobalSign USB token setup

Frequently asked questions about Code Signing

Find answers to the most common questions about SSL certificates and FairSSL.

What is the difference between OV and EV Code Signing?

OV Code Signing shows the company name and requires standard organisation verification. EV Code Signing has stricter requirements and is required for Windows kernel-mode drivers. Microsoft states that EV no longer gives an advantage in SmartScreen: both types build reputation over time as more users download the signed software.

Does Code Signing require a hardware token?

Yes. Since June 2023, both OV and EV Code Signing require the private key to be stored on certified hardware (FIPS 140-2 Level 2+). You can choose between a physical USB token (included), Azure Key Vault Premium or Google Cloud KMS.

How quickly is a Code Signing certificate issued?

GlobalSign OV can be issued the same working day if the order reaches us during business hours. GlobalSign EV usually takes one working day more. DigiCert OV and EV usually take 2-3 working days. These are typical times, not guarantees: they assume we can reach you and that you return the signed documents right away.

Do Code Signing certificates work for PowerShell scripts?

Yes. You can sign PowerShell scripts with an OV or EV Code Signing certificate, so they run under the AllSigned and RemoteSigned execution policies. Under AllSigned, PowerShell asks before it runs a script from a publisher that is not in the Trusted Publishers store.

Does the shorter SSL lifetime affect Code Signing?

Publicly trusted SSL certificates can be valid for at most 199 days now and 99 days from 15 March 2027. Code Signing certificates are not affected by this change. Code Signing certificates have their own maximum validity of 460 days (approximately 15 months), set by the CA/Browser Forum.

Will my signed software still show a SmartScreen warning?

Initially, yes. SmartScreen evaluates the reputation of the file and its publisher, not just whether the signature is valid, and Microsoft states that this applies to OV and EV alike. Reputation builds with each clean download, and Microsoft names no fixed threshold. The verified publisher name is shown in the warning from the first download.

Why can't I get a Code Signing certificate as a .pfx file anymore?

Since June 1, 2023, the CA/Browser Forum requires all Code Signing private keys to be stored on hardware that meets FIPS 140-2 Level 2 or Common Criteria EAL 4+. Software-only .pfx files no longer meet this requirement. You can use a USB token (included), Azure Key Vault or Google Cloud KMS instead.

Can I use Azure Key Vault instead of a USB token?

Yes. Azure Key Vault Premium with HSM-backed keys meets the FIPS 140-2 Level 3 requirement and is ideal for CI/CD pipelines and remote signing. See our complete guide to Code Signing key storage options.

Ready to sign your software?

A code signing certificate requires your company to be validated, so it is not issued in minutes. We help you choose the certificate and key storage and keep you informed during validation.

See code signing certificates Contact us

SSL Automation

Code signing certificates cannot run on SSL Automation: they have no DNS challenge, and the key lives in an HSM or on a token. Your TLS certificates can.

See SSL Automation →