Digital Signing · code signing certificates
Stop Windows calling your software an unknown publisher
Windows tells every person who downloads your installer that the publisher is unknown, and all but asks them not to run it. Signing puts your verified company name there instead.
- Unsigned software loses you installsSmartScreen puts a full-screen “Windows protected your PC” warning in front of your installer, with the Run button hidden behind More info. A measurable share of people stop there and never come back.
- Your name, checked by a certificate authorityThe CA confirms your company legally exists at the address you claim. That verified name is what replaces “Unknown publisher” in the dialog every one of your users sees.
- Reputation that compounds instead of resettingUnsigned, every new build is a stranger to Windows. Signed, every download accrues to one stable identity — which is also what makes antivirus false positives decay.
- Some doors are closed without itKernel-mode drivers cannot be registered with Microsoft at all without an EV certificate, and a growing number of enterprise deployment policies refuse unsigned binaries outright.
What one certificate signs, for as many files as you ship
- .exe, .dll, .msi, .cab, .ocx
- PowerShell scripts
- Java and Adobe AIR
- Office VBA macros
- $369a year, standard validation
- 25% offits list price of $492
- Unlimitedfiles signed — no per-build cost, ever
- 1–3 daystypical time to issue
What changes the moment you sign
One line in one dialog, seen by every person who has ever downloaded your software. It is a small change and it is the whole product.
Publisher: Unknown publisher
SmartScreen adds a full-screen “Windows protected your PC” interstitial on top, with the button to continue hidden behind More info. A measurable share of people stop there.
Publisher: Acme Software Ltd
Your verified legal name, checked by a certificate authority. With extended validation the SmartScreen interstitial goes on the first download; with standard validation it fades as installs accumulate against your identity.
-
And, so you are not disappointed, what it does not do
- It does not inspect your code. A certificate attests who published the file and that nobody altered it afterwards. It makes no claim that the software is any good or safe.
- It is not an instant antivirus fix. It gives scanners a stable identity to attribute reputation to, which is what makes false positives decay — but a brand new certificate carries no history on day one.
- It is not an Apple Developer ID. Signing and notarising macOS applications requires a certificate issued by Apple, which nobody else can sell. These cover the Windows and Java side.
The only decision that matters: standard or extended
Both put your company name on the installer, both use the same cryptography, and both now require the key to live on hardware. What separates them is how fast Windows starts trusting you — and whether you are allowed to ship a driver at all.
Short version. Buy extended validation if you ship a Windows driver, or if the first week of downloads matters more to you than the price difference. Otherwise buy standard, sign everything you release with it, and let the reputation build — which it does, on its own, at no extra cost.
The certificates
Seven of them, and the differences are smaller than the price spread suggests. Every one signs the same file formats and is trusted by the same Windows installations.
Standard validation
Your company name on the installer. Reputation builds with use.
Comodo Code Signing Certificate
The cheapest way to get your registered company name onto an installer. Identical platform coverage to everything above it — what you give up is the length of the free reissue window.
- Ships on a hardware token
- Issued in 1-3 days
- Free reissues for 30 days
Thawte Code Signing CA - G2
Free reissues with no limit for the whole term, which is worth having if you sign from several build machines or expect to replace hardware mid-term.
- Ships on a hardware token
- Issued in 1-3 days
- Unlimited free reissues
- $50,000 warranty
Certum Standard Code Signing Certificate in the Cloud
Keys live in Certum’s HSM and you sign over the network. No hardware to wait for, nothing to plug into a build server — the only practical option if signing happens inside CI.
- Cloud HSM — nothing shipped, signs from CI
- Issued in 1-5 days
Symantec Code Signing Certificate
The legacy enterprise choice, carrying by a distance the largest warranty on this page. Worth the difference only when a procurement policy names the brand.
- Ships on a hardware token
- Issued in 1-3 days
- Unlimited free reissues
- $1,500,000 warranty
Extended validation
Immediate SmartScreen trust, and the only route to signing a driver.
Comodo EV Code Signing
Extended validation on the Comodo root. SmartScreen reputation from the first download, and the certificate Microsoft accepts for registering kernel-mode drivers.
- Ships on a hardware token
- Issued in 1-5 days
Sectigo EV Code Signing Certificate
Comodo CA and Sectigo are the same certificate authority under two names, and these two are the same certificate with different branding on the paperwork. Take whichever your policy names.
- Ships on a hardware token
- Issued in 1-5 days
Certum EV Code Signing in the Cloud
Extended validation with cloud key storage. EV trust in an automated pipeline, without a token physically present in a build server.
- Cloud HSM — nothing shipped, signs from CI
Also in this category
Newer additions we have not written a note for yet.Sectigo Code Signing Certificate
Sectigo Code Signing SSL Certificate make sure that your code or compilation is not tempered in mid-way during online transfer. This certificate...
Before you order: the key does not come as a file any more
Every code signing key now lives on hardware
Since 1 June 2023 the CA/Browser Forum has required the private key for every code signing certificate — standard as well as extended validation — to be generated and held on hardware certified to FIPS 140-2 Level 2 or Common Criteria EAL4+. There is no downloadable .pfx any more, from any supplier, at any price. If you have signed before and remember installing a file, that is the change.
So pick your delivery: a token in the post, or a cloud HSM
A token is physically shipped to you and plugs into the machine that signs — simple, but allow for delivery, and it has to be present in a USB port every time you build. A cloud HSM keeps the key in the authority’s own hardware and you sign over the network, so there is nothing to ship and it works from a build pipeline. The two Certum products above are cloud; the rest ship a token.
Always timestamp, and keep the token safe
A timestamped signature stays valid after the certificate expires; an untimestamped one stops verifying the day it does, and every copy already downloaded starts warning. It costs nothing and it is one flag. And a lost token cannot be recovered — the key only ever existed there — so it means revoking and reissuing.
What comes with the price
- Lowest price guaranteeFind the same certificate cheaper anywhere and we match it.
- We check it before you are billedCode signing cannot be refunded once the certificate is issued, so we confirm the organisation details will pass vetting first. Read the policy.
- Sign everything you publishOne certificate, unlimited applications, for the whole term.
- Help through the vettingOrganisation checks stall on small things. We chase them for you.
- Real engineers, 24×7People who have driven these through the process before.
- Multi-year termsTwo and three-year options cut the yearly rate and the paperwork.
Questions people ask before buying one
Will signing stop antivirus flagging my installer?
Not on its own, and anyone who tells you otherwise is selling. What it does is give scanners and SmartScreen a stable identity to attribute every download to, so reputation accumulates instead of resetting with each build. False positives decay as that history builds — immediately with extended validation, over weeks with standard.
Do I need a separate certificate for each application?
No. One certificate signs everything you publish, for as many products and as many builds as you like, for the whole of its term.
What happens to software I already shipped when the certificate expires?
If you timestamped the signature, nothing — it stays valid indefinitely, because verification checks that the certificate was valid at the moment of signing. If you did not, every copy in the wild starts warning on the expiry date. Timestamp everything; it is one extra flag and it is free.
Can I sign a Windows driver with the standard certificate?
No. Kernel-mode drivers have to be submitted through the Microsoft Hardware Dev Center, and registering there requires an extended validation certificate. There is no way around it and no cheaper route.
Does this let me sign and notarise a macOS app?
No, and no certificate authority can sell you that. Apple issues Developer ID certificates itself, through the Apple Developer Program. These certificates cover Windows executables and installers, Java, Adobe AIR and Office VBA.
We sign inside a CI pipeline. Does a token work for that?
Poorly — a USB token has to be physically present in the build machine, which is awkward on a hosted runner and impossible on an ephemeral one. Choose one of the cloud HSM products instead: the key stays in the authority’s hardware and your pipeline signs over the network.
Not sure which one, or stuck in the vetting?
Tell us what you publish and who for. We will say which of these is genuinely right — including when the cheapest one is — and if the organisation checks stall, we chase the authority rather than leaving you to it.