Code Signing
Choose a certificate, prepare validation documents, sign your releases, and troubleshoot signatures.
26 articles in this category
How to Verify a Code Signature (Windows, Linux & Java)
One verdict, three separate checks — integrity, trust chain, and time. The exact commands for SignTool, PowerShell, osslsigncode and jarsigner, what each status value means, why /pa decides the answer on Windows, and how to gate a build on the exit code instead of the log text.
How Long Does Code Signing Validation Take?
Individual certificates validate in about a business day, Standard (OV) in 1–3 business days, and EV in roughly 1–7 — then key delivery adds its own wait. What the CA checks at each tier, why a shipped USB token can outlast validation itself, and the three stalls that hold up most orders.
Do I Need a Code Signing Certificate?
You need a code signing certificate if you distribute Windows software people download and run — apps, installers, drivers, scripts, or JARs — to remove the 'Unknown Publisher' warning and prove the code is untampered. When you need one, when you don't, and what macOS and mobile use instead.
Open Source Code Signing Certificates: Who Qualifies and What They Cost
An Open Source Code Signing certificate is the cloud-based, individual-only entry tier of code signing: cheapest, no hardware token, and reserved for non-commercial open-source software. Who qualifies, the fixed "Open Source Developer" publisher label, what it can't sign, and how it compares to Standard and EV.
Azure Trusted Signing vs a Code Signing Certificate: Which to Use?
Azure Trusted Signing (now Artifact Signing) is a $9.99/mo managed service that signs only Windows files for eligible US/CA/EU/UK entities. A CA code signing certificate is a portable, cross-platform credential you own — including Java JARs — open to publishers worldwide. How the two models differ on cost, eligibility, and what you can sign, plus a decision path.
Code Signing Certificate Price: What OV and EV Cost in 2026
Standard (OV) code signing runs about $215–$400/year and EV about $280–$690/year across CAs in 2026, with My-SSL's Certum options at $99 and $299. What drives the price, the token and cloud costs the sticker hides, and how the 460-day cap changes multi-year plans.
EV vs OV Code Signing: Which One Do You Actually Need?
EV vs OV code signing in 2026: EV no longer skips SmartScreen, so standard OV is the right choice for most publishers. When EV is still required (kernel drivers, enterprise policy), what both now cost, and how the 460-day validity and hardware-key rules affect each.
The 'Unknown Publisher' Warning: Why It Appears and How to Fix It
The 'Unknown Publisher' warning appears when Windows can't verify who signed a program. What triggers it, how it differs from the SmartScreen 'unrecognized app' warning, why it can survive signing, and how a trusted code signing certificate replaces it with your verified name.
Code Signing Certificate Validity: The New 460-Day Limit
Since March 1, 2026, publicly trusted code signing certificates max out at 460 days — down from about three years — under CA/Browser Forum Ballot CSC-31. What changed, who's affected, how multi-year purchases now work as reissues, and how to plan renewals without a signing gap.
Code Signing in CI/CD: How to Automate Signing Without Exposing Your Key
Since 2023 there's no key file to paste into a CI secret — automating signatures means connecting the pipeline to certified hardware. Compare USB tokens on self-hosted runners, SimplySign cloud sessions on a dedicated agent, and pipeline-native services, plus the design rules that keep unattended signing safe.
Code Signing Timestamps: Why Your Signature Outlives Your Certificate
A timestamp is a TSA's signed proof of when you signed — it's what keeps every shipped build trusted after your certificate expires. How RFC 3161 timestamping works, the commands for SignTool, PowerShell, and jarsigner, and the cases where a timestamp can't help.
Cloud Code Signing vs USB Tokens: Where Should Your Signing Key Live?
Since June 2023 every code signing key must live on certified hardware — the question is whose. Compare USB tokens, cloud signing (SimplySign), and your own HSM on delivery time, team sharing, CI/CD fit, and what happens when things get lost.