Code Signing Certificates for Individual Developers

Can an individual developer get a code signing certificate?

Yes, and the question is better asked as which one. Publicly trusted code signing comes in three tiers, and two of them are issued to natural persons. Open Source certificates are individual-only by design. Individual Validation — the same product certificate authorities sell as Standard or OV code signing — validates a person's identity and address rather than a company's registration. Only Extended Validation is closed to a bare individual, because the EV guidelines are written around organizations, and a person who has registered nothing is not one.

That last point is where most advice on this question goes wrong in both directions. Half the answers online say you need a company to sign code at all, which is false and has cost solo developers years of shipping unsigned binaries. The other half say individuals can get anything, which is also false, and sends people into an EV order they cannot complete. The accurate version has a hinge in it: the commercial question decides whether Open Source is available, and the registration question decides whether EV is.

Worth separating early, because it saves an argument with support later: registering a sole proprietorship is not the same as incorporating. A sole trader registered with a government agency is treated as a Business Entity under the EV rules — the category that also covers general partnerships and unincorporated associations — without becoming a limited company. If you already invoice clients under a registered trading name, you may be closer to the EV route than you assume.

What name will Windows show when you sign as a person?

The name in the certificate's subject is the name your users read, and each route produces a different one. Sign with an Individual Validation certificate and your verified legal name appears — not a project name, not a studio name you invented, and not a pseudonym. Sign with an Open Source certificate and a fixed generic publisher label appears instead, shared with every other holder of that tier. Sign with a sole proprietor EV certificate and the registered business name appears. Nothing about the file you built changes; what changes is the identity attached to it.

For a developer who has been shipping under a project brand for years, seeing a personal name in a security prompt for the first time is a genuine surprise, and it is the most common late regret in this decision. It is not negotiable through the certificate authority — the subject has to match what was verified — so the only lever is which entity you validate. Decide that before you order rather than after the certificate is issued and non-refundable.

There is a second-order effect worth planning around. Reputation in Microsoft SmartScreen accrues to the signing identity, so the name you choose is also the account your trust is banked in. A developer who signs as a person for two years and then incorporates does not carry that reputation across to the new company certificate; the new identity starts where the old one began. If incorporating is on your roadmap for the next year or two, that argues for doing it before you start signing rather than after — a point covered in more depth in our guide to how SmartScreen publisher reputation is earned.

Route one: the Open Source tier, and the line it draws

The Open Source tier is the cheapest publicly trusted code signing available, it is issued to individuals only, and it is delivered in the cloud so there is no token to wait for. It also has the narrowest scope of the three: it is reserved for non-commercial open source software, and it publishes a fixed Open Source Developer label rather than your name. Those three facts travel together, and the last one surprises people who bought it expecting their own name in the prompt.

The commercial line is the part to read carefully before ordering. Publishing your source under an open licence is not by itself enough if the binaries you sign are sold, bundled with a paid tier, or distributed as part of commercial work — the tier is scoped to the software, not to your intentions about it. A dual licensed project with a paid edition is the classic case that does not fit. If you are unsure which side of the line a project sits on, our breakdown of who qualifies for Open Source code signing walks through the eligibility rules and the fixed publisher label in detail.

Where it fits well: a hobby project, a community tool, a utility you maintain because you use it. The generic label costs you personal reputation but buys you the thing that actually matters for a free download — the file is signed, unmodified since you built it, and no longer flagged as coming from an unknown source.

Route two: Individual Validation, for commercial software

Individual Validation is the route most solo developers with a paid product end up taking. It is the same certificate authorities sell as Standard or OV code signing, issued to a natural person after checks on identity and address rather than on a company. It carries no restriction on commercial use, it signs the same file types as the organization version, and technically the resulting signature is indistinguishable in strength from a company's. The only real difference is whose name is in the subject.

The paperwork is lighter than people fear. Certum's documentation for a private person asks for proof of identity and proof of the address that will appear in the certificate details, and gives an energy or telephone invoice or an official confirmation of address as acceptable evidence of the second. What catches applicants out is mismatch rather than volume: an address on a utility bill that differs from the one on the order, a name transliterated differently on the passport than on the application, a document too old to be accepted. Every one of those turns a two-day validation into a two-week one.

One expectation to set honestly: this is the tier where the SmartScreen question bites hardest, because you are building reputation for a name no user has seen before. Signing removes the unknown publisher warning immediately, but a brand-new identity still accrues download reputation over time rather than arriving with it. Anyone promising otherwise is describing something Microsoft does not document. For what to expect in the first weeks after your first signed release, see why a signed executable can still be flagged.

Route three: EV without a limited company

Extended Validation is not available to a private individual, but it is reachable for a registered sole proprietor. The EV guidelines define a Business Entity as an eligible subject — explicitly including sole proprietorships, general partnerships and unincorporated associations — which is why a registered sole trader qualifies while an unregistered person does not. The distinction is registration with a government agency, not incorporation, and that is a much lower bar than most solo developers assume.

The cost is validation weight. Because a non-incorporated business has thinner public records than a limited company, certificate authorities verify a Principal Individual behind the business, and some require that identity check to be conducted face to face rather than on paper. Budget more calendar time for an EV sole proprietor order than for a company's, and read your certificate authority's own procedure before ordering — this is the tier where practice varies most between CAs. Our comparison of EV versus OV code signing covers what the extra validation buys once you have it.

Whether it is worth it comes down to one honest question: are you distributing software where a faster reputation ramp changes your business, or do you simply want the unknown publisher warning gone? For the second, Individual Validation does the job at a fraction of the effort. For the first — a paid Windows product with real download volume, a driver, or anything going through the Windows Hardware Program — EV is the tier that keeps doors open, and registering as a sole trader is the step that gets you there.

Where your private key is allowed to live

Since 1 June 2023, every publicly trusted code signing certificate must have its private key generated and stored in hardware certified to FIPS 140-2 Level 2, Common Criteria EAL 4+ or equivalent. That applies to Open Source, Individual Validation and EV alike; there is no individual exemption and no small-developer carve-out. The practical consequence is that the old workflow — generate a CSR on your laptop, download a .pfx, sign from it — no longer exists for publicly trusted certificates, and any tutorial still describing it predates the change.

That leaves two shapes. A USB token, generated on the device and non-exportable, which signs offline and depends on nothing but being plugged in. Or a cloud signing service holding the key in a hosted HSM, which signs from wherever you are, including a build pipeline. Key sizes moved at the same time: expect RSA of at least 3072 bits, or an ECDSA equivalent.

For an individual specifically, the cloud option tends to win on logistics rather than security — both are certified hardware. A token has to be posted to you before you can sign anything, has to be in the machine that builds, and becomes a genuine problem if you travel, replace a laptop, or lose it, since a lost token means reissuing the certificate. A hosted key removes all four of those. The trade-off is a dependency on the service being reachable at the moment you sign, which our side-by-side on cloud code signing versus USB tokens weighs in full.

What the 460-day cut changed for solo developers

Ballot CSC-31 reduced the maximum validity of a code signing certificate from 39 months to 460 days for certificates issued on or after 1 March 2026. Several certificate authorities began issuing at 459 days a few days before the deadline to stay clear of the boundary, which is why you will see both numbers quoted. Certificates issued before the change keep running to their original expiry, so nothing was revoked — the change is entirely about what you can buy now.

For a team with a certificate manager this is an operational detail. For an individual it is more than that, because everything the renewal touches is also you: the identity documents, the address evidence, the validation call, and the token logistics if you chose a token. What used to be a once-every-three-years chore now lands roughly annually. Multi-year orders still exist and are still worth buying, but understand what they are — a price lock with scheduled reissues, not one long certificate.

Timestamping is what keeps a shorter certificate from becoming a shorter shelf life for your software. A signature carrying an RFC 3161 timestamp records when the signing happened, so verification still succeeds after the certificate expires — the installer you shipped last year does not start warning users on renewal day. Treat the timestamp as part of the signing command rather than an option, because an untimestamped signature genuinely does expire with the certificate, and there is no way to add one afterwards. Our guide to code signing timestamping covers the servers and the flags.

Choosing between the three

The decision resolves in two questions, asked in order. Is the software non-commercial open source? If yes, the Open Source tier is the cheapest thing that will do the job, provided the generic publisher label is acceptable to you. If no, do you have a registered sole proprietorship? If not, Individual Validation is your route and your own name is the publisher. If you do, EV is also on the table, and whether to take it depends on download volume rather than on budget.

The row that changes the most minds is the third. Everything else on this table can be revisited at renewal; the publisher name is what your users learn to recognise, and starting over on it later costs you the reputation you spent a year building.

FAQ