Code Signing
A code signing certificate digitally signs software, scripts, drivers, and other executables so users and platforms can verify the publisher and that the code has not been tampered with.
GeoCerts sells DigiCert OV and EV code signing certificates through CertCommand. After June 1, 2023, public code signing private keys must stay on approved hardware (USB token, HSM, or DigiCert KeyLocker)—not in a software keystore or exportable PFX.
This section is the GeoCerts home for code signing setup and management (the how-tos formerly listed under Code Signing Certificates on the Support Desk).
459-day maximum validity. Newly issued public code signing certificates cannot exceed 459 days (DigiCert’s implementation of the CA/Browser Forum’s 460-day cap). Multi-year product terms may still be sold, but you must reissue during the term. See Change Log — 459-day CS validity.
How this section is organized
- Get Started — Choose a provisioning method and order in CertCommand. Start here for your first code signing certificate.
- USB eToken — Install SafeNet, load the certificate with the DigiCert Hardware Certificate Installer, and manage PINs and lockouts.
- DigiCert KeyLocker — Cloud HSM provisioning without a shipped token or your own HSM.
- Cloud HSM — Generate a CSR on Azure Key Vault or AWS CloudHSM and merge the issued certificate.
- Sign your code — Thin SignTool and jarsigner examples after the certificate is provisioned.
- Troubleshooting & FAQs — Expired init codes, locked tokens, Azure merge mismatches, and Java keytool errors.
OV vs EV
| OV Code Signing | EV Code Signing | |
|---|---|---|
| Validation | Organization validation | Extended validation (identity + organization) |
| Typical use | Apps, scripts, Java JARs, internal distribution | Windows SmartScreen reputation, high-assurance publisher identity |
| Key storage | Approved token, HSM, or KeyLocker | Same—hardware-protected, non-exportable |
| Issuance time | Usually faster after org validation | Additional identity checks; allow extra business days |
Both products require hardware-protected keys. EV does not mean “USB token only”—KeyLocker and a qualifying HSM (for example Azure Key Vault Premium with RSA-HSM) can satisfy EV key storage.
Before you begin
You will need:
- A GeoCerts CertCommand account
- A decision on where the private key will live (token, KeyLocker, or your HSM)
- Administrative access on the machine you use to install or sign
If you are setting up code signing for the first time, work through Get Started in order.
Get Started with code signing »