Code Signing certificates

Sectigo code signing certificates allow software publishers to digitally sign their code, including applications, executables, scripts, and programs, to confirm that the software has not been altered after release.

Without a digital signature verified by a trusted Certificate Authority (CA), major operating systems like Microsoft Windows will show end users a warning message before installation. This reduces downloads and adoption and leaves unsigned or weakly signed code vulnerable to tampering and supply-chain attacks.

Sectigo Code Signing certificates build user trust, protect against unauthorized modification, and support faster releases with streamlined issuance and reduced operational friction.

4.2
Star rating on

Trustpilot
25%
Savings off list price with
Free Token with 5-year purchase deal
5
Years of worry-free

code signing
Free
FIPS-Compliant token will be shipped to you each year, for the duration of your package.

Item 1 of 4

OV Code Signing certificate

FIPS-compliant device delivery

Organization Validation (OV) offers baseline trust and fast issuance
Free token will be shipped to you each year
Meet CA/Browser Forum authentication standards and Microsoft specifications
Establishes reputation in Windows, and Microsoft Edge
Increase user confidence by showing the identity of the signing party before applications are run
Supports all major 32-bit/64-bit formats, including Microsoft Authenticode (kernel and user mode files, like .exe, .cab, .dll, .ocx, .msi, .xpi, and .xap), Adobe Air, Apple applications and plug-ins, Java, MS Office Macro and VBA, Mozilla object files, and Microsoft Silverlight applications
Includes timestamp functionality for continued operation even after the code signing certificate has expired

Recommended

EV Code Signing certificate

Highest level of security

Extended validation (EV) offers highest level of security
Free token will be shipped to you each year
Meet CA/Browser Forum authentication standards and Microsoft specifications
Establishes reputation in Windows, and Microsoft Edge
Increase user confidence by showing the identity of the signing party before applications are run
Protects private key from theft via hardware token and PIN
Supports all major 32-bit/64-bit formats, including Microsoft Authenticode (kernel and user mode files, like .exe, .cab, .dll, .ocx, .msi, .xpi, and .xap), Adobe Air, Apple applications and plug-ins, Java, MS Office Macro and VBA, Mozilla object files, and Microsoft Silverlight applications
Includes timestamp functionality for continued operation even after the code signing certificate has expired

HSM Code Signing certificate

Bring your own hardware

Issue code signing certificates directly onto your own supported hardware security module
Meet CA/Browser Forum private key protection requirements without a shipped physical token
Built for automated build pipelines, CI/CD environments, and centralized signing infrastructure
Compatible with leading enterprise and cloud HSM environments
Backed by Sectigo's key attestation and validation process
Same trusted publisher identity and tamper-evident protection as our standard Code Signing Certificates

Contact sales

Secure Code Signing without slowing down your releases

Code signing shouldn't block releases or scare away users. Sectigo's verified certificates boost install rates, eliminate signing delays, and protect every build from unauthorized tampering.

OS security warnings + lost installs

The problem: Users abandon downloads when Windows or browsers warn them that your software is unknown or untrusted.
How we help: Sectigo verifies your publisher identity and signs your software so operating systems recognize you as trusted.
What you get: Fewer security warnings lead to higher install rates, stronger user confidence, and smoother adoption of your application.

Slow releases and DevOps friction

The problem: Developers waste time navigating validation steps, hardware requirements, and manual signing workflows that slow releases and disrupt pipelines.
How we help: Sectigo streamlines validation and supports modern DevOps workflows so code signing integrates directly into your release process.
What you get: You ship faster, reduce manual overhead, and keep development moving without security becoming a bottleneck.

Risk of tampered code and supply chain attacks

The problem: Security teams worry about malware injection and compromised builds that can damage customer trust and brand reputation.
How we help: Sectigo protects private keys with FIPS-compliant hardware and verified identity checks to prevent unauthorized signing.
What you get: Your software stays protected from tampering, giving customers confidence in every release while safeguarding your brand.

Updated code signing regulations

Starting February 23, 2026, the CA/B Forum has changed the maximum certificate lifecycle for Code Signing certificates. Industry regulations require all Certificate Authorities to issue certificates no longer than 459 days (approximately 15 months). Certificate Authorities must ensure that the subscribers private key is generated stored and used in suitable FIPS-compliant hardware.

Why the change?

Requirements for private keys used with EV code signing certificates have been stronger than OV code signing certificates which are more relaxed.

The new rules are intended to reduce the potential misuse of code signing certificates and to further protect those certificates from getting into the wrong hands by making key protection requirements for OV code signing certificates the same as EV code signing certificates.

Important dates for Code Signing timeline

As of February 23, 2026, you will no longer be able to issue a single multi-year Code Signing certificate on a single FIPS-compliant device. Instead, if you purchase a multi-year Code Signing product from Sectigo you will receive a new compliant hardware device with a new certificate each year.

How do code signing certificates work?

The code signing process works by using public key cryptography and cryptographic hashing to create a digital signature that binds a software package to a verified publisher identity. When code is signed, a unique fingerprint of the software is created, encrypted with the publisher’s private key, and attached to the code along with the code signing certificate so it can be verified before distribution.

When an end user downloads or installs the software, the operating system verifies the signature using the corresponding public key. If the signature is missing, invalid, or untrusted, the end user will receive an error or warning message.

Intuitive dashboard

In our customer dashboard, you'll be able to view all products you have with Sectigo, view their lifecycle status, issue or reissue, and renew expiring certificates, saving you time and fear that an expired certificate may down your site at an unexpected time.

Trusted by leading brands globally

Securing some of the world’s largest and best-known brands.

FAQs

Have another question?

Reach us by chat in the lower-right corner.

What is a Code Signing certificate?

A code signing certificate is a digital certificate that lets software publishers sign applications, drivers and scripts. The signature shows who published the software and that it hasn't been altered since signing, so operating systems and users can trust it. Learn more in our blog: What is code signing?

What is the difference between OV and EV code signing?

Both OV and EV certificates verify your organization, protect the private key with FIPS-compliant hardware, and are valid for up to 459 days.

EV certificate uses stricter, extended identity verification and is the type Microsoft requires for Windows driver submissions.
OV certificate is a lower-cost fit for internal, B2B and general application signing. Neither guarantees instant SmartScreen reputation. Compare prices in the table above.

Can I sign code without a USB token?

Yes. Sectigo can issue code signing certificates directly onto your own supported hardware security module (HSM), so no physical token is shipped. This suits CI/CD pipelines and centralized signing. We support Luna, YubiKey, Google Cloud KMS, Fortanix, YubiHSM 2 and nShield. Industry rules require the private key to be generated and stored in FIPS-compliant hardware, so software-only key storage isn't permitted. Talk to an expert to confirm your environment.

How do I get a certificate for Code Signing?

There are certain requirements that need to be fulfilled during the code signing certificate validation process. The three main things that must be verified before issuance include:

The legal existence of the organization or individual named in the Organization field of the certificate must be verified.
The email to which the code signing certificate is to be sent must be [email protected], where domain.com is owned by the organization named in the certificate.
A callback must be made to a verified telephone number for the organization or individual named in the certificate in order to verify that the person placing the order is an authorized representative of the organization.

As of June 1, 2023 Code Signing certificates are:

Installed on a Sectigo token and shipped securely to the customer.
Available as a download to be installed on the customer’s own HSM. The hardware devices (e.g. tokens, HSMs, etc.) must be FIPS-compliant and support externally verifiable key attestation.

Does an EV code signing certificate remove Windows SmartScreen warnings immediately?

No. Since 2024, Microsoft no longer gives EV-signed files instant SmartScreen reputation. EV and OV signed software both build reputation over time, based on your signing identity and the file itself, so a new release can still show a warning at first. A valid signature still displays your verified publisher name. To build reputation faster, sign every release with the same certificate identity, timestamp each signature, and don't modify files after signing.

How much does a Code Signing certificate cost?

A Sectigo® code signing certificate starts at $536.25 per year when customers choose the five-year option. The cost goes up for shorter time periods and for EV code signing certificates.

How long is a code signing certificate valid?

Since February 23, 2026, publicly trusted code signing certificates are valid for a maximum of 459 days (about 15 months), under CA/Browser Forum rules. A multi-year Sectigo plan doesn't issue one long certificate. You receive a new certificate and a new FIPS-compliant hardware token each year. Timestamp your signatures so signed software stays valid after the certificate expires.

Product refunds

Code Signing certificates are installed on a physical token and shipped to your location. We can only provide full refunds for products that have not been shipped. Once a product has shipped and within 30-days from order, we will refund the product cost, less shipping and token cost.

Do you support code signing on my own HSM?

Yes. In addition to our standard token-based Code Signing Certificates, Sectigo can issue code signing certificates for use with your own supported hardware security module. This option is best suited for organizations with existing HSM infrastructure or automated signing workflows. Talk to an expert to see if this is the right fit for your environment.

Which HSM infrastructures do you currently support?

We currently support Luna, YubiKey, Google Cloud KMS, Fortanix, YubiHSM 2, and nShield HSM infrastructures. Talk to an expert if you need help confirming compatibility for your environment.