Certum EV Code Signing Certificate

Sign software with a verified organization identity and a protected signing key built for trusted software distribution. This guide covers EV eligibility, validation, hardware and cloud key protection, Windows signing, driver signing, SmartScreen reputation, 2026 validity rules, and the operational lifecycle of the certificate.

View Current Pricing

EV Code Signing Registered organizations

From €359 listed starting price

ValidationExtended Validation

Certificate validityUp to 459 days

Minimum keyRSA 3072 bit

Card key storageCC EAL6+

Cloud optionSimplySign

Certificate formatX.509 v3 / RFC 5280

EVExtended organization validation

459 daysCurrent maximum per certificate

RSA 3072Minimum key length

Card or cloudTwo signing key delivery models

What Is Certum EV Code Signing?

Certum EV Code Signing is a certificate for digitally signing software while associating the signed release with verified organization information. The certificate is issued to an organization rather than an individual, and the signing process uses a protected private key to create a verifiable signature over the release artifact.

Identity

Verified organization Organization information is validated before issuance.

Signing layer

Protected private key The key creates the signature while remaining protected by the selected card or cloud model.

Software

Signed release Users and systems can inspect the publisher identity and verify the signature.

Who Can Get Certum EV Code Signing?

Certum states that EV Code Signing certificates are issued only to organizations and cannot be issued to individuals. The applicant therefore needs an eligible legal organization, organization information, an authorized representative, and the required identity and verification evidence.

Registered legal entityThe applicant must be an eligible organization.

Organization informationLegal and registration details must be supplied.

Authorized representativeThe subscriber must have authority to represent the organization.

Physical officeCertum requires confirmation of a physical office registered to the organization.

Identity verificationThe subscriber's identity must be verified.

Verification evidenceDocuments and public registry information may be used during validation.

Applicant path: Individual developer → Standard Code Signing. Qualifying open source developer → Open Source Code Signing. Registered organization seeking EV validation → Certum EV Code Signing.

What Does EV Add Compared With Standard Code Signing?

The meaningful distinction is the scope and rigor of organization validation. EV does not turn the certificate into a software security audit. It changes how the publisher identity is established and makes the certificate relevant to scenarios where stronger organization validation is required.

Area	Standard	EV
Individual applicants	Supported	Not supported
Company applicants	Supported	Supported
Organization identity	Standard validation	Extended Validation
Hardware protected key	Supported	Supported
Windows software signing	Supported	Supported
Microsoft Hardware Program scenario	Scenario dependent	Relevant EV use case
Primary distinction	Standard publisher validation	Enhanced organizational validation

Check Whether EV Fits Your Signing Requirements

Compare EV validation, organization eligibility and protected key requirements before choosing a certificate for production software releases.

Explore Certum EV Certificate

What the EV Certificate Establishes

01Verified organization identityThe certificate identifies the organization that passed the required validation.

02Software integrityA valid signature can show that signed content has not been modified after signing.

03Publisher associationThe signature associates the release with the identified publisher.

04Certificate chainSystems can validate the certificate through its issuing chain.

05Release authenticityUsers can inspect signing identity when evaluating signed software.

06Timestamp evidenceA trusted timestamp records when the valid signature was created.

What EV Code Signing Does Not Guarantee

A signed application is not automatically a safe application.

EV Code Signing establishes a verified signing identity and provides a software integrity mechanism. It does not mean the application is malware free, security audited, bug free, approved by Microsoft, or guaranteed to avoid every SmartScreen warning. A certificate also does not establish that an organization is trustworthy for every purpose.

Certum EV Validation Requirements

EV validation is built around the legal identity of the organization and the authority of the subscriber who requests the certificate. Certum's support documentation also requires confirmation that the organization has a physical office registered to the organization's data.

Organization evidence

Legal organization identity
Registration information
Physical office information
Public registry information
Contact information

Subscriber evidence

Subscriber identity
Authorized representative
Identity verification
Authority to represent the organization
Additional CA verification when required

How Certum Verifies an EV Applicant

OrderStart the EV Code Signing purchase and activation process.

Organization dataProvide legal organization and registration information.

Subscriber checkVerify the subscriber identity and authority.

Organization checkComplete organization and office verification before issuance.

Identity methodUse an accepted identity verification route.

Key generationCreate or activate the protected signing key.

Certificate issuanceReceive the certificate after required validation is complete.

Release signingUse the certificate with the selected signing workflow.

Documents Required for Certum EV Code Signing

Registration detailsOrganization registration and legal details.

Office detailsEvidence supporting the organization's physical office.

Identity documentCurrent identity evidence for the subscriber.

Authority evidenceProof of authority where required.

Automatic verificationCertum lists automatic identity verification as one route.

Alternative verificationRegistration Point, notarial or photo based methods may be available.

Certum's support documentation says public registry documents used for verification should meet its stated age requirements, while identity documents must be valid on the certificate issue date.

How Long Does Certum EV Validation Take?

Certum currently lists 1 to 7 days as the standard issue time after verification for EV Code Signing. The actual process can vary with the completeness of submitted information, organization verification, identity verification, authorization checks, and any additional CA review.

PrepareGather organization, office, subscriber and identity information before starting.

VerifyComplete the identity and organization checks required for EV issuance.

IssueCertum lists 1 to 7 days as its standard issue time after verification.

ActivateComplete the selected card or SimplySign setup and prepare the signing environment.

Private Key Protection

The certificate is public. The private key is the signing secret. EV workflows therefore put strong emphasis on keeping that key inside a protected signing environment rather than treating it like an ordinary file that can be copied between machines.

Credential

Private keyUsed to create the cryptographic signature and must remain protected.

Protection

Crypto card or cloudCertum offers a hardware card model and a SimplySign cloud model.

Access

PIN or controlled authenticationSigning access is separated from the public certificate.

If the private key is compromised, an attacker may be able to create signatures that appear to come from the organization until the certificate and signing environment are contained and remediated.

Certum EV Hardware Card

For the physical product, Certum uses a cryptoCertum cryptographic card. Its current EV product specifies RSA 3072 bit minimum keys and CC EAL6+ key storage. The card based activation process uses a compatible reader and proCertum CardManager.

Card

CryptoCertum cardProtected environment for the signing key.

Reader

Card readerConnects the cryptographic card to the signing workstation.

Manager

proCertum CardManagerInitializes the card and manages PIN and PUK operations.

Sign

Signing applicationUses the protected key to sign the release artifact.

Certum EV Code Signing in the Cloud

Certum also offers EV Code Signing through SimplySign. The cloud option removes the physical card and reader from the local signing setup. The current Certum product specifies SimplySign Mobile, SimplySign Desktop, a SimplySign account, and Internet access.

SimplySign workflow

Mobile accessSimplySign Mobile generates access codes.

Desktop bridgeSimplySign Desktop connects the computer to the virtual cryptographic card.

Cloud keyThe signing key remains in the protected cloud environment.

Software signingThe signing tool uses the virtual card path to create the signature.

Cloud technical requirements

SimplySign Mobile on Android or iOS
SimplySign Desktop
SimplySign account
Internet access
RSA 3072 bit minimum key
FIPS 140-2 Level 3 or CC EAL4+ key storage

Certum's current cloud product also states a usage limit of 5,000 signatures per month.

Hardware Card vs SimplySign Cloud

Factor	Cryptographic card	SimplySign cloud
Physical card	Required	No
Card reader	Required	No
Cloud access	No	Yes
Local setup	Higher	Lower
Remote workflows	More operationally complex	More suitable for remote access
CI/CD planning	Requires careful signing infrastructure	Can fit remote signing workflows
Key protection	CC EAL6+ card	FIPS 140-2 Level 3 or CC EAL4+ stated by Certum
Internet dependency	Not inherent to every local operation	Required

Certum EV Code Signing and Windows Authenticode

Windows Authenticode is the signing mechanism used for many Windows software artifacts. A Certum EV certificate can be used with Windows signing tools to attach the publisher certificate, signature and timestamp information to supported files.

WindowsEXESign executable releases and let Windows inspect the embedded signature.

WindowsMSISign installer packages used for software deployment.

WindowsDLLSign supported dynamic libraries as part of the release process.

Build artifact
      ↓
SignTool
      ↓
Certum EV certificate + protected private key
      ↓
Authenticode signature
      ↓
Timestamp
      ↓
Verify signature and certificate chain
      ↓
Publish release

Certum EV and Microsoft SmartScreen

Certum states that EV Code Signing supports building Microsoft SmartScreen reputation and can reduce the likelihood of SmartScreen warnings. That should not be presented as a universal bypass. SmartScreen considers reputation signals, and newly released software can still encounter warnings.

What signing contributes

Verified publisher identity
Signed software rather than anonymous software
Publisher reputation signal
Application integrity verification

What can still happen

New application reputation may be limited
Users may still see security prompts
Certificate type alone does not approve the application
Software behavior and reputation remain relevant

Certum EV for Windows Drivers

EV Code Signing is a significant use case for organizations working with the Microsoft Windows Hardware Program. Certum identifies EV Code Signing as compatible with creating an account in the Microsoft Windows Hardware Program for driver signing.

OrganizationComplete the required organization validation.

EV certificateObtain and activate the protected signing credential.

Microsoft programMeet the separate Windows Hardware Program account and submission requirements.

Driver workflowSign and submit driver packages according to the applicable Microsoft process.

Purchasing the EV certificate does not by itself complete Microsoft's driver signing or Hardware Program requirements.

Certum EV for Java and Cross Platform Software

The certificate is not limited to Windows. Certum lists compatibility with Java and signing tools installed on Linux, Unix and macOS systems. The exact artifact and signing command depend on the technology and toolchain.

JavaJAR / WARUse Jarsigner or the appropriate Java signing workflow.

macOSApple signing toolsUse the applicable macOS signing workflow and toolchain.

Linux / UnixPlatform toolsUse the signing tools supported by the target platform and artifact.

How to Sign Software With Certum EV

Build

Create release artifactFreeze the artifact that is intended for publication.

Protect

Control signing accessKeep the private key in the card or cloud signing environment.

Sign

Create signatureUse SignTool, Jarsigner or the applicable platform tool.

Timestamp

Add trusted timeTimestamp the signature during release signing.

Verify

Inspect the signatureCheck publisher identity, chain, validity and timestamp.

Publish

Distribute releasePublish only the verified signed artifact.

Timestamping

Timestamping separates the time the software was signed from the later expiration date of the certificate. Certum recommends adding a timestamp so that signed applications can remain installable after the certificate expires, provided the signature was created while the certificate was valid.

Signing date

Certificate validThe signature is created while the EV certificate is valid.

Timestamp

Trusted signing timeThe timestamp records evidence of when the valid signature was created.

Later

Certificate expiresThe certificate can expire without making a properly timestamped historical signature equivalent to an unsigned release.

Certum EV Certificate Validity in 2026

Certum's current shop states that from February 27, 2026, a single Code Signing certificate can be valid for a maximum of 459 days. Certum's broader transition notice describes the change as a maximum of about 460 days from March 1, 2026.

1 year productA certificate issued under the current rules is limited to the applicable maximum validity.

2 year productThe product term can remain available, but the certificate must be reissued within the validity limits.

3 year productContinuous use requires one or more free reissues during the product service period.

Continuity planningTrack certificate expiry and start reissue work before the active certificate reaches its limit.

Important: A 3 year product does not mean one certificate remains valid for 3 years. It provides a service period during which compliant certificates can be issued through the required reissue process.

Certum EV Code Signing Cost

EV Code Signing set

From €359 current listed price

Physical EV set including the certificate and cryptographic card. The current Certum shop also notes that the listed product is out of stock at the time of review.

View Official Certum Pricing

€329 fromEV electronic code for customers who already have a compatible Certum card and reader.

€379 fromEV Code Signing in the Cloud through SimplySign.

Other costsConsider card or reader requirements, signing infrastructure, reissue operations and CI/CD controls.

Choose a Signing Method That Fits Your Workflow

If your release process needs remote signing, review cloud code signing before deciding between a physical cryptographic card and SimplySign.

Explore Cloud Code Signing

Certum EV Code Signing for CI/CD

The signing architecture should separate ordinary build activity from production signing. The certificate should not become a general purpose credential available to every developer or build job.

Build

Build serverCompile and package the release without exposing the signing key.

Controlled signing

Signing service or workstationAllow only approved production artifacts to reach the signing credential.

Release

Publish verified artifactVerify signature and timestamp before distribution.

Access controlLimit who can initiate production signing.

Key isolationKeep private key operations outside ordinary source control and build storage.

Artifact controlSign only the intended release artifact.

SecretsDo not place signing credentials in source repositories.

AuditabilityRecord which release was signed and when.

Reissue planningInclude certificate lifecycle events in release operations.

What Happens If the EV Private Key Is Compromised?

The private key is the sensitive credential. If it is exposed, treat the incident as a signing infrastructure compromise rather than as a normal certificate expiration event.

Stop signingPrevent further use of the affected credential.

RevokeStart the certificate revocation process as appropriate.

InvestigateIdentify affected releases and signing activity.

ReplaceSecure the environment and obtain replacement signing credentials.

RebuildReplace credentials in the release workflow.

ReviewAssess published artifacts and timestamps for impact.

Expiration, Renewal and Reissue

Expiration

The current certificate reaches its validity end date.

Reissue

A new certificate is issued under an existing multi year product or service period.

Renewal

A new certificate or service period is purchased or renewed.

Timestamping

Preserves evidence of when a valid signature was created and is particularly relevant to long lived releases.

Certum EV Certificate Chain

Signature verification is not limited to the leaf certificate. A verifier may need to build the certificate chain through the issuing intermediate and trusted root, then validate the signature and its associated timestamps.

Root

Trusted root CAAnchors trust in the platform's certificate store.

Issuer

Intermediate CAConnects the end entity certificate to the trusted root.

Software

End entity certificateIdentifies the organization associated with the signature.

How to Verify a Certum EV Signed Application

Windows GUI

Open the file properties, select Digital Signatures, open the signature details and inspect the certificate.

Certificate inspection

Review subject, organization, issuer, validity, thumbprint, signature algorithm, timestamp and chain.

SignTool

Use command line signature verification as part of build or release checks.

Java

Use Jarsigner verification where the signed artifact and Java workflow require it.

Artifact
  ↓
Signature details
  ↓
Publisher identity
  ↓
Certificate validity
  ↓
Certificate chain
  ↓
Timestamp
  ↓
Verification result

Common Certum EV Code Signing Problems

EV certificate not visibleCheck activation state, certificate store access and the selected signing environment.

Smart card not detectedCheck reader connection, reader driver and card initialization.

PIN or PUK issueReview card activation and credential management procedures.

CardManager problemCheck proCertum CardManager installation and card communication.

SignTool cannot find certificateCheck certificate visibility and the signing provider path.

Signature verification failureInspect the artifact, certificate validity, chain and signature details.

Timestamp failureCheck timestamp configuration and network access to the timestamp service.

SmartScreen warningRemember that signing does not guarantee the absence of every reputation based warning.

SimplySign connection problemCheck Mobile, Desktop, account and Internet connectivity.

Cloud authentication issueReview access code and SimplySign authentication steps.

Certum EV vs Other Certum Certificates

Requirement	Open Source	Standard	EV
Individual developer	Yes, when qualifying	Yes	No
Registered company	No	Yes	Yes
Open source specific	Yes	No	No
Company identity	No	Can be included	Yes
Enhanced organization validation	No	No	Yes
Microsoft Hardware Program scenario	Not the target	Not the target	Relevant use case
Main purpose	Open source publishing	General software signing	Higher organizational validation

When Certum EV Is Not the Right Certificate

Individual developer

Review Certum Standard Code Signing because Certum EV is not issued to individuals.

Qualifying open source project

Review Certum Open Source Code Signing when the project and applicant meet its requirements.

Ordinary software signing

Compare Standard and EV requirements before selecting the validation model.

Microsoft driver signing

Check the current Microsoft Windows Hardware Program requirements in addition to the certificate requirement.

Buying and Validation Checklist

Confirm eligibilityVerify that the applicant is an eligible organization.

Confirm legal detailsPrepare organization registration information.

Confirm officePrepare physical office information.

Identify representativeChoose the subscriber who can represent the organization.

Prepare identity documentsUse current and acceptable identity evidence.

Select card or cloudChoose the signing architecture before activation.

Plan key protectionKeep signing credentials out of ordinary developer workflows.

Configure timestampingMake timestamping part of the release process.

Plan reissue datesTrack the 2026 certificate validity limit.

Test verificationVerify the signature, chain and timestamp before release.

Secure production accessRestrict who and what can invoke the signing process.

Document lifecycleRecord issue, expiry, reissue, revocation and renewal events.

Certum EV Code Signing FAQ

What is Certum EV Code Signing Certificate?

It is an Extended Validation code signing certificate that associates signed software with verified organization information and uses a protected signing key.

Who can get a Certum EV Code Signing Certificate?

Certum states that EV Code Signing certificates are issued only to organizations and cannot be issued to individuals.

Can an individual developer get Certum EV Code Signing?

No. Certum's current support documentation states that EV Code Signing is issued only to organizations.

Does Certum EV require a registered company?

Yes. The EV process is organization based and requires organization information and verification.

What documents are required for Certum EV Code Signing?

Requirements can include organization registration information, physical office information, subscriber identity and authority evidence, plus accepted identity verification.

Does Certum verify the company's physical office?

Yes. Certum states that confirmation of a physical office registered to the organization's data is required.

How long does Certum EV validation take?

Certum currently lists 1 to 7 days as its standard issue time after verification.

How much does Certum EV Code Signing cost?

Current Certum listings show EV physical set pricing from €359, electronic code from €329 for customers with their own compatible card and reader, and cloud pricing from €379.

Is Certum EV Code Signing available in the cloud?

Yes. Certum offers EV Code Signing in the Cloud through SimplySign.

What is Certum SimplySign?

SimplySign is Certum's cloud signing solution that removes the need for a physical card and reader and uses Mobile and Desktop components for access.

Can Certum EV sign EXE files?

Certum lists .exe among supported file extensions, depending on the signing tool used.

Can Certum EV sign MSI files?

Yes. Certum lists .msi among supported file extensions, depending on the signing tool.

Can Certum EV sign DLL files?

Certum lists .dll among supported file extensions, depending on the signing tool.

Can Certum EV sign Java JAR files?

Yes. Certum lists Java compatibility and .jar among supported file extensions.

Can Certum EV be used for Windows drivers?

Certum identifies EV Code Signing as compatible with creating an account in the Microsoft Windows Hardware Program for driver signing. Microsoft has additional program requirements.

Does Certum EV eliminate SmartScreen warnings?

Certum states that EV signing supports SmartScreen reputation and reduces the likelihood of warnings. It should not be presented as a universal guarantee that warnings cannot appear.

Does Certum EV automatically bypass Microsoft SmartScreen?

Do not treat EV as an automatic bypass. SmartScreen uses reputation signals, and newly released software may still receive warnings.

How long is a Certum EV Code Signing certificate valid?

Certum's current shop states a maximum of 459 days for certificates issued under the 2026 rules.

Why does a 3 year Certum EV product require reissues?

Because the product service period can be multi year while each individual Code Signing certificate must comply with the current maximum validity limit.

What happens when a Certum EV certificate expires?

The certificate reaches the end of its validity period. A properly timestamped signature created while the certificate was valid can retain useful evidence of signing time.

Can a Certum EV certificate be revoked?

Yes. Certificate revocation is part of certificate lifecycle management and is especially relevant when a private key is compromised or another revocation condition applies.

What happens if the Certum EV private key is compromised?

Stop signing, begin revocation and investigation, secure the signing environment, replace the credential, and review affected releases.

Can Certum EV be used in CI/CD?

Yes, but the signing architecture should isolate the private key and restrict production signing access. The cloud option can change the operational model.

Is Certum EV better than Certum Standard?

The products serve different validation requirements. EV is intended for organizations requiring Extended Validation, while Standard supports general software signing with a different validation model.

Related Resources

Evaluate Certum EV Around Your Signing Workflow

For a registered software organization, the important questions are practical: can the organization complete EV validation, which key protection model fits the signing environment, how will Windows or cross platform artifacts be signed, and how will reissues be handled under the 2026 validity rules?

View SimplySign Cloud Code Signing for Software Companies