Choose a provisioning method
The provisioning method is where the private key is generated and stored. You select it when you order (or reissue) in CertCommand. You generally cannot move a key from a USB token to KeyLocker or an HSM later—you would reissue with a new key on the new method.
Hardware only. Since June 1, 2023, public OV and EV code signing private keys must be generated and stored on a FIPS 140-2 Level 2 (or equivalent) token, HSM, or DigiCert KeyLocker. Do not generate a software CSR or PFX unless you are installing on an approved HSM and can attest to that.
Comparison
| Method | CSR at order time? | Key lives on | Best when | After issuance |
|---|---|---|---|---|
| DigiCert-provided USB eToken | No | Shipped SafeNet eToken | You sign on a workstation, want DigiCert to supply the token | Install with Hardware Certificate Installer + init code |
| Your own supported token | No | Your certified SafeNet (or other approved) token | You already have an approved eToken | Install on that token |
| DigiCert KeyLocker | No | DigiCert cloud HSM (FIPS 140-2 L3) | CI/CD, sign from anywhere, no physical token | Access in DigiCert ONE / KeyLocker |
| Azure Key Vault (HSM) | Yes — generate in AKV first | Azure Premium Key Vault, RSA-HSM, non-exportable | You already use Azure for secrets and signing | Merge the issued cert into the same AKV cert object |
| AWS CloudHSM (or other HSM) | Yes — generate on the HSM first | Your CloudHSM cluster (or other qualifying HSM) | You already operate an HSM | Import/bind the issued cert to the same HSM key |
KeyLocker includes a signature allowance on the initial order (DigiCert documents 1,000 signatures; additional signatures are purchasable). Tokens and your own HSM do not use that KeyLocker signature meter.
When to pick each option
USB eToken
Choose a DigiCert-shipped eToken if you sign interactively on Windows (or install once on Windows, then sign on Mac/Linux with SafeNet). You wait for shipping, then initialize the token in CertCommand.
DigiCert KeyLocker
Choose KeyLocker if you do not want a physical token, need to sign from multiple machines or pipelines, or want DigiCert to host the HSM. GeoCerts enables KeyLocker when you select it as the provisioning method on a DigiCert code signing order.
DigiCert KeyLocker with GeoCerts »
Azure Key Vault or AWS CloudHSM
Choose Install on HSM (or equivalent) when you already have a qualifying HSM. Generate the key and CSR on the HSM first, then paste that CSR into the GeoCerts order. DigiCert will email an HSM attestation for the requester to confirm.
Azure Key Vault »
AWS CloudHSM »
Key size
- RSA: 3072-bit minimum; 4096 is the usual default for tokens.
- ECC: P-256 or P-384 where the token/HSM and signing tool support it.
EV and current CA/Browser Forum rules require at least RSA 3072 or ECC P-256.
Related topics
- Order a code signing certificate
- Code Signing — OV vs EV