Code Signing Centre - support for signing applications
Customer Support Centre for Code Signing certificates (certificates for signing codes and applications). Here you will find all relevant information regarding code signing and the use of Code Signing certificates.
Code Signing Certificates
Code Signing Certificates (Code signing) are used to sign applications created on various development platforms. The goal of signing the code is not only to authenticate the publisher, but mainly to protect the authenticity of the application and its immutability. If someone modifies the application (for example, adds malware), the signature ceases to be valid. Therefore, most current systems either require an application signature (MacOS) or strongly warn you before running an unsigned application (Windows).
Code Signing EV Certificates
We also offer a certificate with extended validation for code signing certificates. You will find its advantages and instructions on activation in the following paragraphs.
The significance of Code Signing EV Certificate
Its significance is better security of the certificate and private key. The certificate is stored on the token together with the private key and cannot be exported. The use of the certificate is password protected and after several bad attempts the token will be deleted. This is an excellent protection for your code signing certificate from misuse.
More information about the Code Signing certificate in our offer can be found on the product page DigiCert Code Signing EV.
How to get and activate a Code Signing EV Certificate
The whole process of obtaining and activating a Code Signing EV Certificate is described in the article Activating a Code Signing EV Certificate.
How to Sign Software with a Digital Certificate
To sign applications using Code Signing, you need two things:
- A Code Signing certificate
- A signing application
You can obtain a Code Signing certificate from SSLmarket easily. The signing application depends on the platform you're developing on. Below are the most popular and widely used signing tools. These are described in our documentation, and we can help you use them:
- Signtool from the Windows SDK (guide)
- Jarsigner (see blog article)
- smctl utility from DigiCert – recommended for KeyLocker (guide). It can work with tools like signtool and simplifies the signing process.
Most of our customers develop in a Microsoft Windows environment and use the Windows SDK. Signing is typically done with the signtool.exe tool. You can find the documentation for signtool on the SignTool.exe (Sign Tool) page on Microsoft's website.
Signing with a cloud HSM
A cloud HSM is used to securely store a Code Signing certificate and provide remote access to it. Unlike a certificate on a token, it enables automation and signing is very fast, because only the file hash is sent to the cloud (so-called hash signing).
We strongly recommend hash-signing with the cloud over using a token. It is secure, fast and inexpensive.
Recommended cloud HSMs
- DigiCert KeyLocker
- DigiCert Software Trust Manager
- Azure Key Vault
- GCP Cloud KMS (Google)
- AWS CloudHSM
In the following paragraphs you will find the advantages and disadvantages of each solution.
DigiCert KeyLocker
The cheapest alternative to a token is KeyLocker. It is a simple single-user service that enables easy code signing. DigiCert provides its own KSP and PKCS#11 libraries which you install on your system, and you sign code exactly the way you are used to. With their SMCTL utility, signing is even easier and more straightforward than with signtool. SMCTL is compatible with the most widely used Code Signing tools and can call them. KeyLocker has a limit of 1,000 signatures, so it is suited for less frequent signing. The number of signatures can, however, be extended for a fee.
DigiCert Software Trust Manager
This is the top-tier cloud solution from the DigiCert ONE platform, designed for enterprise use. It offers management of an unlimited number of certificates and users and is unlimitedly scalable. Integration with your CI/CD platform is provided by ready-made scripts and libraries. Access to STM and the number of signatures are licensed. For more information on price and licensing, do not hesitate to contact us. Documentation can be found on the DigiCert website.
Azure and Google cloud HSM
Both major cloud providers offer an HSM service with secure remote access via their own libraries that act as KSPs on Windows. Their use is not complex and the price of both is very favourable (you only pay for crypto operations). We recommend Azure and GCP for high yearly signing volumes because the costs are low.
You can find a guide for code signing with Azure Key Vault in the article Code signing using Azure Key Vault. For GCP Cloud KMS see the article Code signing using Google Cloud KMS.
AWS CloudHSM
With Amazon it is also possible to sign via the cloud using Signtool from the Windows SDK, but a provisioned HSM is charged per hour of operation. In addition to the fixed costs, you also pay for operations (signatures). If you are not yet using AWS, we recommend Azure or GCP HSM instead. More information about using Signtool can be found in the article Use Microsoft SignTool with Client SDK 3 to sign files.
Comparison: Azure Key Vault vs Google Cloud KMS vs AWS CloudHSM/KMS+HSM
You will find a comparison of all three cloud HSMs in the following table. It focuses on costs per signing operation (hash signing), fixed fees, scaling, low utilization, operational complexity and latency/throughput.
| Factor | Azure Key Vault | Google Cloud KMS | AWS CloudHSM / KMS + HSM |
|---|---|---|---|
| Fees for operations (sign/verify) | Very low (≈ $/10,000 operations). | Very low (≈ $/10,000 operations). | Not the main cost; fixed HSM fees dominate. |
| Fixed costs | Possible monthly fee per HSM key; otherwise low. | No significant fixed costs in the basic mode. | High – hourly HSM rental (24/7) or Custom Key Store. |
| Scaling and capacity | Linear with transactions; limited by throttling. | Linear; watch out for quotas (QPS/QPM). | Scale by adding HSMs; fixed cost grows too. |
| Cost at low utilization | Favourable — you mainly pay for operations. | Favourable — you mainly pay for operations. | Unfavourable — the HSM is paid for even under no load. |
| Operational complexity | Low — managed service. | Low — managed service. | Higher — HSM cluster management and HA/DR. |
FAQ – Frequently Asked Questions
No, Code Signing certificates are not issued for a domain name, but for a specific organization. The organization name appears in the Common Name field.
With a DigiCert Code Signing certificate, you can sign various types of software and scripts to ensure they come from a trusted source and have not been modified after signing.
You can sign:
- Executable files: .exe, .dll, .ocx, .msi, .cab
- Windows drivers (WHLK/HLK)
- Java applications: .jar
- Macros and VBA scripts in Microsoft Office
- PowerShell scripts: .ps1
- macOS apps and packages (via Apple Developer ID)
- Adobe AIR applications
- .NET applications and libraries
- Scripts and installers across various platforms
You cannot sign:
- Code requiring a qualified electronic signature under eIDAS
- Files not intended for distribution
- Formats and platforms that don’t support digital signatures
Yes, timestamped code remains valid even after the certificate expires. If you use a timestamp during signing, the system verifies that the code was signed while the certificate was valid. This ensures the signature remains trusted. Without a timestamp, the code would need to be re-signed with a new certificate.
See the article Instructions for timestamping VBA code on DigiCert.com.
No, you can sign an unlimited number of applications with your certificate. If the certificate is stored on a token, there are no signing limits. However, cloud-based services do apply limits:
- DigiCert KeyLocker – includes 1,000 signatures for the certificate's validity period; additional signatures can be purchased.
- Software Trust Manager – signing is licensed for the contract duration.
Signing with a Code Signing certificate in the cloud is simple and secure. It uses hash-based signing – a hash is generated from the file and sent to the cloud for signing. The actual file is not transferred; only the signed hash is returned. This makes the process efficient and secure.
Cloud-based hash signing is available with the following services:
Contact us
If you are unsure about any step in ordering a certificate, issuing a certificate, installing a certificate, or with any questions, do not hesitate to contact our customer support, who will advise and help you. Our Web Security Sales Expert Plus certified professionals are available on weekdays during normal business hours.
You can also contact us directly from your customer account by sending a request from the Authorized Request menu.
ZONER, inc.
3902 Henderson Blvd Suite 208-187
Tampa, FL 33629
VAT ID: CZ49437381
Invoice address: ZONER a.s., Nové Sady 18, 602 00 Brno
Has this article been useful?
Thank you for your feedback on this article.
We are sorry that you did not find the required information here.
Please help us to improve this article. Write us what you have expected and not found out.