Choose OV or EV
DigiCert offers two public code signing certificates through GeoCerts: Organization Validation (OV) and Extended Validation (EV). Both sign the same kinds of files, use the same provisioning methods, and are sold for one year. They differ in how much identity DigiCert checks, how long issuance takes, and whether a Windows driver program requires EV.
Comparison
| OV Code Signing | EV Code Signing | |
|---|---|---|
| Validation | Organization | Organization and a verified individual |
| Choose it for | Apps, installers, scripts, Java JARs, and most other software | Windows Hardware Dev Center registration and kernel-driver submissions, or when a customer requires EV |
| Windows SmartScreen | Shows your publisher name. Reputation builds from download history. | Same behavior as OV |
| Issuance | Usually faster once organization validation is complete | Extra identity checks; allow additional business days |
| Key storage | USB eToken, DigiCert KeyLocker, or your own qualifying HSM | Same options |
| Order term | One year | One year |
Current prices are on the DigiCert code signing page. EV costs more than OV.
When to pick each option
OV code signing
Choose OV for applications, installers, scripts, and JARs. After organization validation, DigiCert can issue the certificate without a separate identity check on an individual.
EV code signing
Choose EV when you will register for the Windows Hardware Developer Program. Microsoft requires an EV code signing certificate on the Hardware Dev Center account before that account can submit kernel-mode drivers for attestation signing or Windows Hardware Compatibility Program (WHCP) certification.
Some customers and procurement policies also ask for EV. The extra check confirms a person’s identity in addition to the organization, so plan on more documents and a longer wait.
Register for the Windows Hardware Developer Program
Driver code signing requirements
SmartScreen
A signed Windows app shows the publisher name from the certificate. SmartScreen can still warn on a new file until that file, or the publisher certificate, builds a download history. OV and EV certificates follow that same path.
Microsoft ended the older behavior in which an EV certificate received immediate SmartScreen reputation. See SmartScreen reputation for Windows app developers.
Next step
When you know which certificate you need, choose where the private key will live, then order.
Choose a provisioning method »
Order a code signing certificate »
Related topics
- Code Signing — Section overview