Code Signing
Choose a certificate, prepare validation documents, sign your releases, and troubleshoot signatures.
27 articles in this category
How to Renew a Code Signing Certificate in 2026
Renewal issues a new certificate, not an extension of the old one — new thumbprint, a 460-day ceiling since March 2026, and SmartScreen reputation that starts from zero. How to plan the overlap so the restart never reaches your users.
How to Verify a Code Signature (Windows, Linux & Java)
One verdict, three separate checks — integrity, trust chain, and time. The exact commands for SignTool, PowerShell, osslsigncode and jarsigner, what each status value means, why /pa decides the answer on Windows, and how to gate a build on the exit code instead of the log text.
How Long Does Code Signing Validation Take?
Individual certificates validate in about a business day, Standard (OV) in 1–3 business days, and EV in roughly 1–7 — then key delivery adds its own wait. What the CA checks at each tier, why a shipped USB token can outlast validation itself, and the three stalls that hold up most orders.
Do I Need a Code Signing Certificate?
You need a code signing certificate if you distribute Windows software people download and run — apps, installers, drivers, scripts, or JARs — to remove the 'Unknown Publisher' warning and prove the code is untampered. When you need one, when you don't, and what macOS and mobile use instead.
Open Source Code Signing Certificates: Who Qualifies and What They Cost
An Open Source Code Signing certificate is the cloud-based, individual-only entry tier of code signing: cheapest, no hardware token, and reserved for non-commercial open-source software. Who qualifies, the fixed "Open Source Developer" publisher label, what it can't sign, and how it compares to Standard and EV.
Azure Trusted Signing vs a Code Signing Certificate: Which to Use?
Azure Trusted Signing (now Artifact Signing) is $9.99 a month for 5,000 signatures, and Basic stays cheaper than Premium up to 23,000 a month. Yearly cost by volume, Microsoft's current eligibility list (individuals only in the US and Canada), what the service cannot sign or export, and when a CA code signing certificate fits better.
Code Signing Certificate Price: What OV and EV Cost in 2026
Standard (OV) code signing runs about $215–$400/year and EV about $280–$690/year across CAs in 2026, with My-SSL's Certum options at $99 and $299. What drives the price, the token and cloud costs the sticker hides, and how the 460-day cap changes multi-year plans.
EV vs OV Code Signing: Which One Do You Actually Need?
EV vs OV code signing in 2026: EV no longer skips SmartScreen, so standard OV is the right choice for most publishers. When EV is still required (kernel drivers, enterprise policy), what both now cost, and how the 460-day validity and hardware-key rules affect each.
The 'Unknown Publisher' Warning: Is It Safe, and How Do You Fix It?
Windows says Unknown Publisher when a file has no signature it trusts. How to tell the UAC, SmartScreen and Smart App Control dialogs apart, check a file before running it, and remove the warning from your own software with a trusted, timestamped signature.
Code Signing Certificate Validity: The New 460-Day Limit
Since March 1, 2026, publicly trusted code signing certificates max out at 460 days — down from about three years — under CA/Browser Forum Ballot CSC-31. What changed, who's affected, how multi-year purchases now work as reissues, and how to plan renewals without a signing gap.
Code Signing in CI/CD: How to Automate Signing Without Exposing Your Key
Since 2023 there's no key file to paste into a CI secret — automating signatures means connecting the pipeline to certified hardware. Compare USB tokens on self-hosted runners, SimplySign cloud sessions on a dedicated agent, and pipeline-native services, plus the design rules that keep unattended signing safe.
Code Signing Timestamps: Why Your Signature Outlives Your Certificate
A timestamp is a TSA's signed proof of when you signed — it's what keeps every shipped build trusted after your certificate expires. How RFC 3161 timestamping works, the commands for SignTool, PowerShell, and jarsigner, and the cases where a timestamp can't help.