Open Source Code Signing Certificate
An Open Source Code Signing Certificate is designed for eligible developers who publish free open source software and want signed releases to identify the signer and help users verify file integrity. The product's eligibility rules matter: an open source licence does not automatically qualify a project for a certificate intended only for noncommercial distribution.
Open Source Code Signing Providers and Prices
Certum is the dedicated open source product confirmed for this page. Other certificate authorities may offer individual or organization validated code signing, but that does not mean they offer a separate open source certificate or accept the same noncommercial eligibility rules. The table separates the dedicated product from alternatives that require direct confirmation.
| Provider | Product or route | Published price | Eligibility and availability notes | Official action |
|---|---|---|---|---|
| Certum | Open Source Code Signing, electronic code | From €25Official shop listing | For individual developers sharing free open source software. Current listing showed out of stock when checked. Confirm stock and full checkout total. | View Product |
| Certum | Open Source Code Signing set with card | From €69Card set listing | Includes a cryptographic card; reader and delivery configuration can differ by set. Current listing showed out of stock. Verify included hardware and return terms. | View Card Set |
| Certum | Open Source Code Signing in the Cloud | From €49Shop category listing | Cloud option is shown in Certum's shop, but current product availability and regional checkout price should be confirmed before purchase. | Check Cloud Option |
| Other CAs | Individual or organization code signing | VariesProvider quote or public price | Consider only after checking whether the product permits your distribution model, represents the identity you need and supports your file formats. Do not assume it is an open source specific product. | Compare Providers |
Pricing note: prices are provider-listed starting figures, not a guaranteed checkout total. Currency, VAT, card or reader costs, cloud signing, shipping, account region and product stock may affect availability and final cost. This is a factual comparison, not a provider ranking.
What Is an Open Source Code Signing Certificate?
It is a code signing certificate offered for a defined category of open source software publishers. A signing tool uses the certificate and its associated private key to create a digital signature on a supported release artifact. A verifier can inspect the certificate identity, validate the signature and check whether the signed file has changed since signing.
Identify the publisher
The certificate contains identity information according to the issuer's policy. Certum's dedicated product uses “Open Source Developer” wording in the certificate identity fields, rather than presenting it as a normal company certificate.
Verify the release
The signature binds the signed content to a cryptographic digest. If the signed file changes after signing, signature verification can detect that change. It does not prove that the program is harmless or free from vulnerabilities.
Support a release process
Signed installers and binaries give users a way to inspect publisher and integrity information before running software. The trust result still depends on the certificate chain, revocation status and the platform's own policies.
Open source licensing and code signing solve different problems. A licence defines permissions and obligations for using, modifying and redistributing source code. A code signing certificate helps verify the signer and whether a signed artifact has changed. One does not replace the other.
Who Needs This Type of Certificate?
A dedicated open source certificate may fit a maintainer who publishes free software under their own identity and meets the issuer's eligibility terms. The key question is not only whether the source is publicly available, but how the project is distributed and what the provider permits.
Potentially suitable
- Individual maintainers publishing free open source applications.
- Volunteer developers distributing compiled builds or installers.
- Project owners who want a consistent signing identity for releases.
- Developers publishing utilities where users download executable artifacts.
When another certificate may fit better
- A company distributing software under its registered organization name.
- A maintainer whose software is sold, bundled commercially or distributed as part of a paid offering.
- A team that needs an organizational publisher identity.
- A project requiring a specific certificate validation model or platform capability.
A project can be open source and still have commercial distribution. For example, a company may sell support, bundle an open source component in a paid product or charge for a packaged build. Review the actual provider terms before assuming that such a project qualifies for a noncommercial certificate.
Eligibility and Application Requirements
Certum's published requirements state that Open Source Code Signing certificates are issued only to individuals. Its support documentation also specifies the identity wording included in the certificate and says the certificate may be revoked if Certum determines it is being used to sign commercially distributed software. Other providers may apply different requirements, so do not treat this list as a universal certificate authority checklist.
Personal identity
Be prepared to complete the issuer's identity verification process and submit the requested identification and application details. The accepted documents and verification route depend on the applicant and current provider instructions.
Project and distribution
Confirm the project is eligible under the provider's definition of open source and noncommercial distribution. Keep project URLs, licence information and release channels available if the issuer requests context.
Certificate identity
Check how the subscriber name will appear in the certificate and in supported operating system dialogs. Certum documents “Open Source Developer” wording in the Common Name and organization field; other products may display different fields.
Official verification source: Certum's code signing required documents guidance describes the provider's requirements. Read the current instructions before buying because document requirements and verification procedures can change.
Open Source vs. Individual vs. OV vs. EV Certificates
These labels describe different product or validation models. The dedicated open source product is defined by its intended use and issuer terms; individual, OV and EV terminology describes other ways a provider may package identity validation. Compare the actual product policy rather than relying on the label alone.
| Comparison point | Open Source product | Individual certificate | OV certificate | EV certificate |
|---|---|---|---|---|
| Typical identity | Individual with product-specific wording | Individual name, according to provider policy | Verified organization | Organization after enhanced validation |
| Intended use | Eligible open source distribution, often with noncommercial limits | Individual's own software or publishing activity | Software published under an organization identity | Organization workflows requiring EV validation |
| Commercial distribution | May be prohibited by product terms | Depends on the certificate and provider policy | Generally used for organization publishing | Generally used for organization publishing |
| Company registration | Dedicated Certum product is for individuals | Not always required | Usually required for organization validation | Required for eligible organization validation |
| Key storage and formats | Depends on the product and supported signing setup | Depends on the product | Depends on current issuance rules and product | Depends on current issuance rules and product |
An open source maintainer does not automatically need a dedicated open source certificate. A standard individual or organization certificate may be appropriate if the project and distribution model meet that product's requirements. Compare the individual code signing certificate, OV code signing certificate and EV code signing certificate pages for those alternatives.
What Publisher Identity Appears in the Signature?
Users and verification tools can display identity information from the certificate, but the exact presentation varies by operating system, file type and signing utility. The name in a certificate is not necessarily the same as a project's name, repository owner or software brand.
Certum's open source identity
Certum states that the certificate includes the phrase “Open Source Developer” in the Common Name field and sets the organization field to “Open Source Developer”. Review a current certificate example or ask Certum how the subject will appear before publishing a release under a specific project identity.
Project name versus signer
A repository or package name does not automatically become the certificate subject. Add release notes and verification instructions that explain who maintains the project, where official downloads are published and how users can validate the signed artifact.
Before ordering: confirm the expected certificate subject, how signing tools display it, and whether that identity is suitable for your project's release process.
Certificate Cost and Key Storage Options
The certificate's advertised price is only one part of the cost. The key storage method, compatible reader, cloud service, delivery charges and project operations can affect the total. Certum lists electronic code, card-based and cloud product routes, but availability can differ by shop region and may change.
Electronic code
Certum's dedicated electronic-code listing starts at €25. Its product page showed out of stock when checked. Confirm that you already have the required compatible cryptographic card and that the product can currently be activated.
Card-based set
The listed set starts at €69 and includes a cryptographic card. Check whether a card reader is included in the selected set, along with shipping, activation and refund terms for the physical card.
Cloud signing
Certum's shop category lists Open Source Code Signing in the Cloud from €49. Confirm current availability, service region, authentication method, signing limits and whether your release automation is supported.
These figures are official shop starting prices observed during research, not a guarantee of stock or checkout cost. See the code signing certificate cost guide for broader cost considerations and compare only options that meet your eligibility requirements.
What Software Can You Sign?
Supported formats depend on the certificate, cryptographic provider, signing tool and target platform. Certum's electronic-code product page lists examples including EXE, MSI, DLL, JAR and WAR files, with compatibility dependent on the tool used. Verify your exact release artifacts before purchasing.
Windows applications
EXE files, DLLs and MSI installers can be signed through compatible Authenticode workflows.
Java packages
JAR and WAR signing may be supported using compatible Java signing tools and certificate access methods.
Scripts and tools
Check support for PowerShell scripts and other formats with the signing tool and target environment.
Release packages
Archives and package formats need a signing method that the ecosystem recognizes. A signed executable does not automatically sign every file inside a release archive.
Do not assume universal compatibility. Test the actual file type, signing utility, certificate chain and target platform. Signing a source repository commit is also different from signing a compiled installer or binary release.
Signing Open Source Releases and Build Artifacts
Build signing into the release process rather than treating it as a final manual task. Keep a clear connection between the source revision, build output, signature, timestamp and published download. That makes it easier for maintainers and users to verify which artifact is official.
Keep release evidence
Record the source tag or commit, build identifier, artifact checksum, signer, timestamp result and release date. Publish checksums and signatures through the project's established release channel, with instructions that users can follow independently.
Separate source and binary trust
Git commit or tag signing can help verify repository history, but it is not the same as signing a compiled installer with a publicly trusted code signing certificate. Projects may use both, for different purposes.
Choose a certificate that fits your release model
Confirm eligibility, publisher identity and key protection before selecting a certificate for your open source releases.
Private Key Protection for Open Source Maintainers
A certificate is only as trustworthy as the process that controls its private key. Open source projects often have distributed contributors, public build systems and maintainers who change over time. The signing key should not be treated like an ordinary repository secret that can be copied freely between contributors.
Restrict access
Keep signing privileges limited to release maintainers or a controlled signing service. Require strong authentication and separate source-code contribution permissions from authority to sign official releases.
Protect and recover
Follow the issuer's storage rules for hardware-backed keys or supported cloud signing. Document device replacement and recovery procedures without exporting or copying the private key in ways the provider does not permit.
Plan for maintainer changes
Define what happens when the certificate owner leaves the project, loses access or can no longer maintain releases. A certificate issued to an individual may not be transferable to another person.
If a private key may be compromised, stop using it for new releases. Investigate the scope, contact the certificate authority about revocation, secure the signing environment and evaluate whether releases signed during the exposure period need additional notice or replacement.
Limitations Developers Should Know
A certificate improves signature verification but does not make every download warning disappear or certify that the software is safe. Understand the boundaries before making claims in your download page or release notes.
Commercial use restrictions
Certum's dedicated Open Source Code Signing requirements state that the certificate is for individuals and may be revoked if it is used to sign commercially distributed software. If your project receives payments, sells packaged builds or is distributed through a commercial product, ask the issuer for a written eligibility decision or choose a product whose terms fit that model.
SmartScreen and platform trust
Signing can help users inspect publisher identity and may contribute to reputation, but it does not guarantee that Microsoft SmartScreen or another platform will stop displaying warnings. Reputation systems, file prevalence, download behavior, certificate status and platform policies remain separate factors.
Expiry and revocation
Certificate expiry, revocation and timestamp status can affect later verification. Proper timestamping can help preserve a signature's validity after certificate expiry under applicable trust rules, but it does not override revocation or every platform policy.
Open source does not mean one publisher
A project may have many contributors but a certificate is issued to a particular subscriber. Decide who owns the release-signing role, how official releases are authorized and how users distinguish signed releases from unofficial builds.
How to Choose the Right Certificate
Start with eligibility and identity, then confirm platform support and key protection. The right option is the one whose published terms fit how your project is funded, packaged, signed and distributed.
Your project meets the noncommercial terms
You publish eligible free software as an individual and want a certificate designed for that use. Confirm the certificate subject wording and restrictions before ordering.
You publish software under your own identity
You need individual publisher identification, but your distribution model does not fit the dedicated product's limits. Confirm the provider permits your specific commercial or noncommercial use.
The publisher should be a registered organization
Your company or eligible organization owns and distributes the software, and the certificate should represent that organization's verified identity.
Your workflow requires EV validation
You have an eligible organization and a documented need for EV validation. Confirm current issuance, key storage and platform requirements rather than assuming EV removes all warnings.
Open Source Code Signing Checklist
Use this checklist before buying the certificate and before signing a public release.
Frequently Asked Questions
Answers to common eligibility, purchase and release-signing questions.
Can I get a code signing certificate for a free open source project?
Potentially. Certum offers a dedicated Open Source Code Signing product for eligible individuals who share free open source software. You must meet its identity verification and usage terms, and current product availability should be confirmed with the official shop.
Can an open source developer use a standard individual certificate?
Yes, if the certificate authority's terms allow the developer's intended use. A standard individual certificate is not automatically equivalent to a dedicated open source product, so check its publisher identity, eligibility, key storage and distribution terms.
Can I use an open source certificate for commercial software?
Do not assume so. Certum's published requirements state that its Open Source Code Signing certificate may be revoked if used to sign commercially distributed software. If you sell software, bundle it into a paid product or distribute a commercial package, ask the provider to confirm eligibility or choose a certificate whose terms allow that use.
Do I need a registered company?
Certum states that its dedicated Open Source Code Signing certificates are issued only to individuals. Other certificate products may require an eligible organization, depending on their validation model and the identity you want displayed.
Can I sign Windows EXE files and Java JAR files?
Certum's electronic-code product page lists support for formats including EXE, MSI, DLL, JAR and WAR, depending on the signing tool. Verify your precise file type, platform and signing workflow with the provider before purchase.
Does signing guarantee that Windows SmartScreen will not show a warning?
No. Code signing helps establish signer identity and file integrity, but SmartScreen uses reputation and other platform signals. A valid signature does not guarantee that warnings will disappear for every download or user.
What happens when the certificate expires?
Expiry does not automatically invalidate every previously signed release. A trusted timestamp may help a signature continue to validate under applicable rules, but revocation status, timestamp validity and platform trust policy still matter.
Can multiple maintainers use the same signing certificate?
Only if the provider's key protection terms and your operational controls allow the intended setup. Do not copy a private key among maintainers without checking the certificate policy. Prefer controlled signing access, named release authorization and documented handover procedures.
What documents are required for an open source certificate?
Requirements depend on the issuer and applicant. Certum directs applicants to its code signing required documents instructions. Review that current guide rather than relying on a generic document list.
Is signing source code the same as signing a release binary?
No. Git commit or tag signing helps verify repository history or a release tag. Code signing a compiled executable or installer creates a signature that supported operating systems and tools can verify on that artifact. A project may use both approaches.
Prepare your next signed release
Review the signing workflow, timestamp verification and private key controls before publishing a new release.