Code Signing Certificate Tutorials

A code signing certificate is not installed the way an SSL certificate is. There is no file to drop onto a server. The private key has to be created inside a piece of certified hardware and stay there for the certificate’s whole life, which changes the order of every step that follows: what you choose at checkout, what you have to send the Certificate Authority, what arrives when validation ends, and what you type when you finally sign something.

These tutorials cover each of those stages for the certificates SSL Dragon sells. Use this page to work out which stage you are at, and to check the handful of rules that apply no matter which Certificate Authority or device you are on.

Quick Navigation

• What Code Signing Certificate Delivery Method to Choose?
• YubiKey 5 FIPS CSR Generation and Attestation
• Luna Network HSM 7: CSR and Attestation Guide
• How to Validate Sectigo and Comodo Code Signing Certificates
• How to Validate DigiCert and GoGetSSL Code Signing Certificates
• How to Set Up an EV Code Signing Certificate on a Shipped Token
• YubiKey 5 FIPS Code Signing Certificate Installation
• How to Sign an EXE File Using a Code Signing Certificate

What Governs Every Code Signing Certificate Now

Three industry changes sit underneath all eight guides below. Reading them first explains why the process looks the way it does, and saves you from following older instructions that are still in wide circulation.

The private key must be generated and held in certified hardware

Since June 1, 2023, the CA/Browser Forum’s Code Signing Baseline Requirements have required the private key to be protected by a crypto module certified to at least FIPS 140-2 Level 2 or Common Criteria EAL 4+. Certificate Authorities can no longer let you generate a key in a browser or on a laptop and download a PFX file afterwards.

Everything else follows from that one rule. It is why the order form asks you to choose a delivery method at all, why an attestation file exists (it is how you prove to the CA that a key it never saw being created really was created inside compliant hardware), and why installing the certificate means putting it into a slot on a device rather than importing it into a server.

Certificates are now valid for months, not years

CA/Browser Forum ballot CSC-31, adopted on November 17, 2025 as Code Signing Baseline Requirements version 3.10.0, cut the maximum validity of a publicly trusted code signing certificate from 39 months to 460 days for certificates issued on or after March 1, 2026. It applies to standard and Extended Validation certificates alike.

Both CAs moved early and both settled on 459 days, roughly fifteen months: Sectigo from February 23, 2026 and DigiCert from February 24, 2026. DigiCert removed its two-year and three-year options at the same time. Any guide, including older versions of these pages, that offers you a three-year code signing certificate is describing a product that no longer exists. Multi-year purchases now mean multi-year coverage with reissuance, not one long certificate. The shorter life is also why timestamping every signature is no longer optional, since a timestamp is what keeps software you have already shipped valid after the certificate expires.

Extended Validation no longer bypasses SmartScreen

EV code signing certificates used to skip the Microsoft Defender SmartScreen warning on a brand new application. That behavior was removed in August 2024, when the EV code signing object identifiers were taken out of the roots in the Microsoft Trusted Root Program. Windows now treats every code signing certificate the same way, and an EV-signed file builds reputation exactly as an OV-signed one does.

EV still means stricter vetting of your organization, and some enterprise procurement rules still ask for it, so it has not stopped being useful. It simply does not buy instant Windows trust any more, and no signing procedure on any of these pages will change that.

Stage 1: Choose or Confirm Your Delivery Method

This is the first decision and the only one you cannot revisit. It determines whether the CA sends you hardware or expects you to supply your own, and it therefore decides which of the guides below apply to you.

What Code Signing Certificate Delivery Method to Choose?

Compares the two options on the order form, a token the CA pre-loads and ships versus hardware you already own, with current shipping costs for each CA, the devices Sectigo and DigiCert actually accept today, what CA-operated cloud signing services do differently, and why the choice is locked at checkout. Read it before you order: it also lists the questions worth settling in advance, such as whether your device is on your CA’s supported list and whether it can actually produce an attestation. If the order already exists, it sets out what can and cannot be changed at that point.

Stage 2: Generate the Key and CSR Inside Your Own Hardware

Skip this stage if the CA is shipping you a pre-loaded token, because the key is generated for you before the device is posted. It applies only if you chose to use hardware you already own, in which case the CA cannot issue anything until you send it a CSR generated on that device plus an attestation package proving the key was created there and cannot be exported.

One warning before you start on a YubiKey: the YubiKey Manager GUI that older instructions rely on reached end of life on February 19, 2026. The ykman command line tool and Yubico Authenticator are unaffected and are what the guides below use.

YubiKey 5 FIPS CSR Generation and Attestation

The full ykman route on a YubiKey 5 FIPS: putting the token into FIPS approved mode first (it refuses to generate a key otherwise), choosing the slot and the key algorithm, producing the key pair and the CSR, exporting the attestation certificate and the Yubico intermediate, and joining them into the single PEM file the CA expects. It also covers the PowerShell encoding trap that makes an otherwise correct attestation file get rejected.

Luna Network HSM 7: CSR and Attestation Guide

The same job on a Thales Luna Network HSM, using the standalone cmu utility from the Luna HSM Client: generating the RSA key pair with the attributes attestation depends on, reading the object handles, building the CSR with the correct signature algorithm, and producing the public key confirmation the CA verifies. Worth reading even if you have run these commands before, because the version published across the industry produces a SHA-1 signed CSR unless you add one option.

Stage 3: Pass Validation

Validation is about who you are, not about your hardware, so it runs alongside stages 1 and 2 rather than after them. The CA confirms that the entity named in the certificate legally exists, that it is reachable at an address and a phone number or email address it can verify from a source other than your order form, and that whoever approved the request was authorized to. This is where nearly every delayed order is stuck, and it is the one stage you cannot speed up by working faster yourself.

The two CAs run different processes, so pick the guide that matches your certificate.

How to Validate Sectigo and Comodo Code Signing Certificates

What Sectigo checks and in what order, for Organization Validation, for individual developers with no company, and for Extended Validation: the registry check on your legal name, the automated Video ID session, address and contact verification, the Subscriber Agreement, the callback that closes the order, and the extra operational-existence and second-review steps EV adds. It also explains why Comodo-branded paperwork turns up on a Sectigo order, and what to do when the government registry alone is not enough.

How to Validate DigiCert and GoGetSSL Code Signing Certificates

DigiCert’s process for CS and EV CS, including the point that trips up most orders: two separate things have to complete, the organization has to be validated for code signing and a verified contact tagged for that certificate type has to approve the request, and the order sits pending until both are done. Covers organization, address and phone verification, the confirmation call, the individual route for developers with no registered company, and what to do when an order stalls.

Stage 4: Get the Certificate onto Your Hardware

Once validation passes, the certificate is issued. What happens next depends on the delivery method you picked in stage 1. Either a token arrives in the post with the key and certificate already on it, or you receive a certificate file to import into the device that generated your CSR.

How to Set Up an EV Code Signing Certificate on a Shipped Token

The route for a token the CA ships to you, which is how EV orders are normally delivered. Covers installing the SafeNet Authentication Client, the order the client and the token have to be connected in, replacing the initial token password the CA emailed you, confirming the certificate is visible to Windows, and finding the thumbprint your signing tool will need. Read the lockout section before you type the password: the token locks after a small number of wrong attempts, and the administrator password that would clear it stays with the CA.

YubiKey 5 FIPS Code Signing Certificate Installation

Importing the issued certificate into the YubiKey slot whose key pair produced your CSR, by either ykman or Yubico Authenticator, plus how to verify the result and what to do when the CA sends a PKCS#7 file that the tooling cannot read. It also settles two things older guides get wrong: which credential the import actually asks for, and where the Sectigo intermediate really needs to be for your signatures to chain correctly.

Stage 5: Sign Your Code and Verify It

The last stage is the one you will repeat for every release, so it is worth getting the command right once and scripting it.

How to Sign an EXE File Using a Code Signing Certificate

Finding SignTool in the Windows SDK without guessing at a version number, the signing command with a SHA-256 digest and an RFC 3161 timestamp, selecting the right certificate on a machine that holds several, the canonical verification check and why it fails without the correct switch, and how to sign from a cloud key or a CI/CD pipeline. It also covers the token-free option Microsoft now recommends for non-Store distribution, and what signing does and does not do about SmartScreen.