Get Started with Code Signing
This is the onboarding chapter for DigiCert code signing with GeoCerts. It takes you from choosing where the private key will live through placing the order in CertCommand.
Work through the steps in sequence unless you already know your provisioning method and have an issued certificate.
459-day maximum validity. Newly issued public code signing certificates cannot exceed 459 days (DigiCert’s implementation of the CA/Browser Forum’s 460-day cap). Multi-year product terms may still be sold, but you must reissue during the term. See Change Log — 459-day CS validity.
The recommended path
1. Choose a provisioning method
Public code signing keys cannot live in a software keystore. Pick USB eToken, DigiCert KeyLocker, or your own cloud/on-prem HSM before you order—the method changes whether you submit a CSR, wait for a shipped token, or sign from CI/CD.
Choose a provisioning method »
2. Order in CertCommand
Request an OV or EV code signing certificate, complete organization (and EV identity) validation, and select the provisioning method from step 1.
Order a code signing certificate »
3. Install or access the certificate
After issuance, follow the guide for your method:
- USB eToken — SafeNet + DigiCert Hardware Certificate Installer
- DigiCert KeyLocker — DigiCert ONE / KeyLocker
- Azure Key Vault or AWS CloudHSM — merge or import the issued cert onto the same key that generated the CSR
4. Sign your code
When the certificate is on the token, KeyLocker, or HSM, use Windows SignTool or Java jarsigner.
Related topics
- Code Signing — Section overview
- Troubleshooting & FAQs — If ordering or install fails