Code Signing Certificate Price: What OV and EV Cost in 2026

Code signing prices at a glance

Standard OV code signing generally runs about $215–$400 per year and EV about $280–$690 per year across publicly trusted CAs, as of July 2026. Those are certificate figures for a one-year term; longer terms lower the per-year rate, and whether a hardware token is bundled shifts the total. The table sets the ranges next to My-SSL's own Certum prices, and the panel underneath shows where the EV premium goes.

The ranges are wide because the CA brand matters as much as the tier: a big-name authority charges a premium over a Certum- or Sectigo-issued certificate that clears Windows identically. Before you assume the cheaper one is worse, it's worth understanding exactly what you're paying for.

What actually drives the price

Code signing pricing comes down to four levers: the validation level (OV or EV), the certificate authority's brand, the length of the term, and how the mandatory hardware requirement is met. Every code signing key must now be generated and stored on hardware — a USB token, an on-premise HSM, or a cloud signing service — so the "certificate" and the "key protection" are really two line items, whether or not a vendor prices them together.

• Validation level. EV requires more human vetting than OV, so it costs more to issue. That's the single biggest swing between two certificates from the same CA.
• CA brand. The same OV validation from a premium brand can cost two to three times what a Certum- or Sectigo-issued certificate does. The trust outcome in Windows is the same.
• Term length. Multi-year plans lower the per-year rate. Since the 460-day validity cap, they're delivered as reissues rather than one long certificate — more on that below.
• Hardware delivery. A shipped USB token, a token you already own, or a cloud signing subscription each carry different costs and lead times.

The details of OV versus EV pricing follow, but the decision itself is covered end to end in our EV vs OV code signing guide — worth a read if the price difference is the only thing pushing you toward one or the other.

Standard (OV): what you pay and get

A standard (OV) code signing certificate runs about $215–$400 per year at the major CAs, and less from value-focused resellers — My-SSL lists its Certum-issued standard certificate at $99/year. For that price the CA confirms your organization is a real, registered legal entity and issues a certificate that stamps your verified company name onto anything you sign. It signs executables, installers, scripts, and drivers' user-mode components exactly as an EV certificate would.

For the large majority of software publishers, OV is the right spend. The one thing it doesn't do is grant instant Windows SmartScreen reputation — but neither does EV anymore, so that's no longer a reason to pay up. Reputation now builds through download telemetry regardless of tier, which we cover in the SmartScreen publisher reputation guide.

EV code signing: why it costs more

EV code signing runs about $280–$690 per year across the major CAs, with My-SSL's EV option at $299/year. The premium over OV pays for two things: deeper identity vetting and stricter key storage. On top of the OV organization check, EV verifies your company's legal, operational, and physical existence and confirms the requester's authority — more human review, which the CA prices in. EV keys must also sit on higher-assurance hardware.

Because the historical SmartScreen advantage is gone, EV is now worth the extra money in a narrower set of cases: registering to submit Windows kernel-mode drivers through the Microsoft Hardware Program, or meeting an enterprise customer's procurement requirement that specifically names EV. If one of those is you, EV is a genuine requirement rather than a nice-to-have. If neither is, the extra spend buys vetting you don't need.

The costs beyond the certificate

The certificate fee is one slice of what you actually pay. Since June 1, 2023, every publicly trusted code signing key must be generated and held on hardware that meets a defined assurance bar — so a compliant token or a cloud signing service is part of the real cost, not an optional extra. Some CAs fold the token into the certificate price; others bill it separately or expect you to supply one. A quote that looks cheap can lose that edge once the hardware line is added.

Cloud signing changes the shape of the cost rather than removing it: instead of buying and shipping a token, you pay a subscription for signing capacity, which is usually the better fit for CI/CD pipelines and remote teams. If you're weighing hardware against cloud, our cloud signing vs USB token comparison lays out the trade-offs on delivery time, team sharing, and pipeline fit.

How the 460-day limit changes multi-year pricing

You can still buy a two- or three-year code signing plan, but since March 1, 2026 no single publicly trusted certificate can be valid longer than 460 days — about 15 months — under CA/Browser Forum ballot CSC-31. That doesn't remove multi-year purchasing; it changes how it's delivered. A three-year plan is now a price lock: you pay once at today's rate, and the CA reissues the certificate roughly every 15 months for the length of the term.

The money upside is real — you fix your rate against future increases and handle one transaction instead of three. The operational cost is that you still re-key and re-sign at each reissue, since the hardware requirement means there's no exportable key to simply carry forward. Plan the renewals so a reissue never leaves you unable to sign. The full mechanics are in our guide to the 460-day validity change.

Is cheap code signing safe?

A low price is not, by itself, a warning sign. A code signing certificate is trusted because the issuing CA's root is in the Microsoft Trusted Root Program and because the key lives on compliant hardware — not because of what you paid. A genuine, publicly trusted OV certificate at the bottom of the market signs your code exactly as a premium one does, and Windows treats both identically. Much of the price difference is brand, not security.

What should make you pause is an offer that quietly drops the hardware requirement, promises to remove SmartScreen warnings outright, or comes from a "CA" you can't confirm is in the trusted root program. A software-only PFX sold as publicly trusted code signing is a red flag on its own — that model ended in June 2023. Verify the CA and the key-storage method, and a low price is simply a low price.

How to buy without overpaying

Buying well is mostly about matching the tier to your actual need and comparing quotes on the full stack rather than the certificate line. Pick OV unless a driver submission or a procurement rule forces EV. Compare the all-in cost — certificate plus token or cloud subscription — across providers. And decide up front whether a multi-year price lock is worth the reissue admin. Do that and you rarely overpay.

Here's where My-SSL's options map to common situations:

FAQ