Code Signing Certificates

Two validation tiers exist, and the buyer’s choice between them comes down to who signs and what they sign.

• OV (Organization Validation) is the standard tier. The CA verifies the legal existence of a registered business and issues to that organization. Comodo and Sectigo also issue OV-equivalent certificates to verified individuals, sometimes called Individual Validation (IV), for solo developers without a registered company. SSL Dragon’s OV options start at $219/year.
• EV (Extended Validation) requires deeper business vetting under the CA/Browser Forum’s EV guidelines. Only registered organizations qualify; individuals do not. EV is the only tier accepted for signing Windows kernel-mode drivers, and many enterprise procurement and audit policies mandate it. SSL Dragon’s EV options start at $287/year.

A note on SmartScreen: a 2024 update to the Microsoft Trusted Root Program changed how reputation accumulates. SmartScreen reputation now builds by file hash and download volume regardless of certificate type. EV no longer grants instant SmartScreen trust. Both OV and EV signed binaries build reputation the same way once they’re in the wild.

Pick OV if you sign user-mode applications and want the lower price tier. Pick EV if you sign Windows kernel-mode drivers, need maximum identity assurance, or have procurement that names EV explicitly.

Since June 1, 2023, the CA/Browser Forum requires every publicly-trusted certificate’s private key to be generated and stored on hardware meeting FIPS 140-2 Level 2 or Common Criteria EAL 4+. Downloadable .pfx files are no longer issued. Buyers pick one of three delivery routes:

1. CA-shipped USB token. The CA mails a pre-loaded FIPS 140-2 Level 2 USB token (typically a YubiKey) to the verified address on the order.
2. Bring-your-own compliant device. If your team already operates a FIPS 140-2 Level 2 or Common Criteria EAL 4+ HSM or token, the CA issues against an attestation from that device.
3. Cloud HSM signing service. The private key is generated and held in a CA-managed cloud HSM such as DigiCert KeyLocker, Sectigo cloud signing, or SSL.com eSigner. No physical token to ship, and signing fits cleanly into CI/CD pipelines.

A USB token is simplest for occasional manual signing; cloud signing fits better for automated builds. All three routes share the same Public Key Infrastructure (PKI): the certificate binds your verified identity to a public key, hardware protects the private key, and the resulting digital signature is what Windows verifies.

Setup steps are in our code signing tutorials.

As of March 1, 2026, publicly-trusted certificates have a maximum validity of 460 days (about 15 months), down from the previous 39-month maximum. The change comes from CA/Browser Forum Ballot CSC-31. Multi-year orders are still sold, but the certificate itself is reissued inside the purchased term rather than spanning it.

What this means at the order level:

• A single new certificate is capped at ~15 months of validity
• 2-year and 3-year orders remain available, with reissuance during the term
• HSM-installed orders may cover the full purchased term but require annual reissuance
• Certificates issued before March 1, 2026 stay valid until their original expiration

Properly timestamped code stays trusted past the certificate’s expiration, so software you’ve already signed and shipped is unaffected. Only the renewal cadence shifts.

SSL Dragon stocks options from four Certificate Authorities. Here’s how the OV and EV options line up on starting price, hardware delivery, and issuance time.

Comodo and Sectigo OV both start at $219/year and are the cheapest publicly-trusted options on this page. DigiCert sits at the premium end, $400 for OV and $685 for EV, and is usually chosen by buyers whose contracts or compliance frameworks specifically name DigiCert. GoGetSSL is the value pick at the EV tier at $369/year. All four CAs ship hardware tokens, with DigiCert also offering KeyLocker cloud signing for HSM-free workflows.

No publicly-trusted Certificate Authority offers free code signing as of 2026.

Two real costs make it unworkable:

1. The CA must verify the publisher’s identity (organization or individual)
2. Since June 2023 the private key must live on FIPS-compliant hardware that someone has to pay for

Self-signed certificates can be generated with OpenSSL and cost nothing, but Windows, macOS, and browsers don’t trust them, so they leave the “Unknown Publisher” warning in place. If price is the deciding factor, Comodo Code Signing and Sectigo Code Signing OV (or Individual Validation for solo developers) are the entry-level SKUs at $219/year.

A certificate from any CA SSL Dragon carries can sign:

• Windows binaries and installers: .exe, .dll, .cab, .ocx, .msi, and .xap files signed via Microsoft Authenticode
• Windows drivers: user-mode drivers (OV or EV) and kernel-mode drivers (EV only)
• Java applications: .jar files signed with jarsigner
• Scripts and macros: PowerShell scripts, VBScript, and Microsoft Office VBA macros
• Other formats: Adobe AIR packages, Mozilla object files, and Microsoft Silverlight (legacy but still valid)
• Firmware and IoT software
• Containers and software packages

The same certificate covers most of the list above; the kernel-mode driver case is the one that forces the EV tier.

An SSL/TLS certificate encrypts the connection between a browser and a website. A code signing certificate digitally signs software so the operating system can verify who published it and that the file hasn’t changed.

The two aren’t interchangeable: one secures a domain, the other proves the origin of an executable. Both are X.509 certificates issued by a Certificate Authority, which is why they get confused.