Get Started with Code Signing

This is the onboarding chapter for DigiCert code signing with GeoCerts. It takes you from choosing OV or EV and where the private key will live through placing the order in CertCommand.

Work through the steps in sequence unless you already have an issued certificate.

1. Choose OV or EV code signing

OV is the usual code signing certificate for apps, installers, scripts, and JARs. EV code signing adds an individual identity check and is what Microsoft requires on a Windows Hardware Dev Center account for kernel-driver submissions. Signing and key storage are the same either way.

Choose OV or EV code signing »

2. Choose a provisioning method

Nowadays, public code signing keys cannot live in a software keystore. Pick USB eToken, DigiCert KeyLocker, or your own HSM before you order—the method changes whether you submit a CSR, wait for a shipped token, or sign from CI/CD.

Choose a provisioning method »

3. Order in CertCommand

Request the certificate type from step 1, complete organization (and EV identity) validation, and select the provisioning method from step 2.

Order a code signing certificate »

4. Install or access the certificate

After issuance, follow the guide for your method:

  • USB eToken — SafeNet + DigiCert Hardware Certificate Installer
  • DigiCert KeyLocker — DigiCert ONE / KeyLocker
  • Your HSM — Azure Key Vault, AWS CloudHSM, or another approved HSM. Merge or import the issued cert onto the same key that generated the CSR

5. Sign your code

When the certificate is on the token, KeyLocker, or HSM, use Windows SignTool or Java jarsigner.

← Back to Code Signing