How Long Does Code Signing Validation Take?

How long does each code signing certificate type take?

Individual certificates validate in about a business day, Standard (OV) in 1–3 business days, and EV in roughly 1–7. Those windows start when your documents are complete and match what the CA can verify — Certum, the CA behind My-SSL's certificates, quotes the same ranges once verification material is in. There is no instant tier: unlike SSL, code signing has no domain-validated level where an automated check does the whole job.

Two things about these ranges are worth internalizing. First, they're conditional: "1–3 business days" assumes the CA can confirm your company and phone number from sources it already trusts. When it can't, the clock pauses until you fix whatever is missing. Second, the ranges describe validation, not readiness to sign — the certificate exists at the end of them, but your key may still be in a courier's van. That second gap is covered in the key-delivery section below.

What happens during code signing validation?

Every publicly trusted code signing certificate goes through identity vetting by a person at the CA. For an individual certificate that means verifying your government ID and personal details. For Standard (OV) and EV, the CA confirms your organization is a real, registered legal entity — by checking a government registry or a qualified independent source such as Dun & Bradstreet — verifies its address and phone number, confirms the applicant is entitled to act for the company, and typically finishes with a verification callback to a number it sourced independently.

The registry lookup explains a pattern that surprises many buyers: uploading more documents doesn't speed things up. The CA prefers confirming your details against sources it already trusts, and documents only enter the picture when those sources come up empty — a company too new to be listed, for example, may need an attorney's opinion letter instead. What the CA will ask for, tier by tier, is catalogued in our Certum code signing documents guide, and having it ready before you order is worth a day or two by itself.

Why does EV code signing take longer?

EV takes longer because it runs more checks, and every check is a chance for a follow-up. On top of the OV verification, the CA must confirm the organization's operational existence, verify the applicant's authority through a separate confirmation, collect signed subscriber agreements, and complete the callback without shortcuts. An established company with a clean registry record often clears EV in 2–3 business days; a company registered last quarter, with no bank reference and an unlisted phone number, is how the range stretches toward seven.

Whether the extra days buy you anything depends on what you ship. Kernel-mode drivers require EV. For a desktop app, Standard (OV) signs identically and — since Microsoft stopped documenting an instant SmartScreen bypass for EV — the reputation argument for paying more has thinned. The EV vs OV comparison works through that decision; make it before you order, because switching tiers mid-validation restarts the clock.

Issued isn't signing: how key delivery adds time

Since June 1, 2023, every publicly trusted code signing key must be generated and stored on certified hardware — there is no emailed PFX file at the end of validation anymore. That rule created a second timeline most buyers don't budget for: after the CA issues your certificate, the hardware holding the key still has to become usable. With a shipped USB token or card, that's courier time — days domestically, up to around two weeks internationally. With a cloud service, the key lives in the CA's HSM and there is nothing to ship.

In the orders we handle, this is the single most common planning mistake: a team gets the "certificate issued" email, tells the release manager it's done, and then watches a tracking number for ten days. If your deadline is inside two weeks, order the cloud variant with SimplySign delivery — activation is an app install and a pairing code, and the first signature can happen the day of issuance. The full trade-off between the two forms, including CI/CD use, is in our cloud vs USB token comparison.

What delays code signing orders most often?

Three causes account for most stalled orders we see through Certum: a phone number the CA can't verify independently, an order that doesn't exactly match the business registry record, and an applicant who isn't a registered representative of the company. None of them means a rejection. Each means the CA is waiting for something, and the order sits until it arrives.

• The unverifiable phone number. Your number can be on your website and every invoice and still not count — the CA needs to find it in a registry, a directory, or another independent listing. This is the same gate that stalls OV and EV SSL orders, and it fails quietly: nobody tells you in advance that your listing is missing.
• Registry mismatches. Ordering as "Acme Software" when the registry says "Acme Software sp. z o.o." triggers a manual round-trip. The certificate will carry your registered legal name, so the order must too — character for character.
• Missing authorization. When the developer placing the order isn't listed as a company representative, the CA asks for a signed authorization (a power of attorney) before it proceeds. In our queue this is the most common EV holdup, and it costs the most days when the person who can sign it is on holiday.
• The unanswered callback. The verification call comes during the CA's business hours, which for Certum means Central European time. A missed call plus a time-zone gap can quietly add a day per attempt.

How can you speed up code signing validation?

You can't pay a CA to skip checks, but you can remove every reason for the clock to pause. Orders that clear on the first pass share the same preparation: the details match official records, the phone number is findable, the right person places the order, and replies go back the same day. In practice that's the difference between one business day and a week — the checks themselves are quick once the CA has what it needs.

• Order in your exact registered legal name — including the "GmbH", "Ltd", or "sp. z o.o." suffix, not the brand you trade under.
• Check your phone listing before ordering. If your number isn't in your business registry entry or a recognized directory, fix that first — it's the top time-saver on OV and EV alike.
• Have a registered representative place the order or prepare the signed authorization up front instead of waiting to be asked.
• Individuals: complete identity verification immediately. The ID check is usually the only gate, and it's one you control entirely.
• Pick cloud delivery when the deadline is close. It converts the entire delivery segment of the timeline to zero.
• Answer the callback and every CA email the same day. Response latency is the one variable that's fully yours.

Do renewals take as long?

Usually not, but they're no longer rare events you can afford to improvise. Certificates issued since March 1, 2026 are capped at 460 days under CA/Browser Forum ballot CSC-31 — most CAs cut over in late February — so renewal is now an annual-ish routine rather than a once-every-three-years project. The CA can reuse identity data it verified recently, within the limits the Code Signing Baseline Requirements set, so a renewal with unchanged company details typically clears faster than a first order. A new key still has to be generated on hardware each time.

The planning rule we give customers: start a renewal three to four weeks before expiry. That absorbs a document request, a missed callback, and token shipping without threatening a signing gap — and if anything changed in your registry record since last year, you'll find out with time to spare. What the 460-day cap means for multi-year purchases is covered in the 460-day validity guide.