Certum Standard Code Signing Certificate
Sign software with a verified publisher identity and protect the integrity of applications, installers, scripts, and other supported code. Certum Standard Code Signing is positioned for both individual developers and companies that need a standard publisher identity for software distribution.
The €139 starting price is the electronic code option for customers who already have a compatible cryptographic card and reader. Card and cloud variants have separate pricing.
View Certum PricingWhat Is Certum Standard Code Signing?
A Code Signing Certificate is a digital certificate used with a private signing key to create a cryptographic signature over software. The signature connects the release to the certificate identity and allows a verification system to determine whether the signed artifact has changed since signing. For Standard Code Signing, the publisher identity can represent an individual, an individual together with an organization, or organization information under Certum's applicable issuance rules.
Signing is not encryption
Code signing does not hide the contents of an application. It creates evidence about who signed the release and whether the signed content was altered after the signature was created. Encryption is a separate security function with different keys, purposes and verification flows.
What happens when software is signed?
The signing tool calculates a digest of the release artifact, uses the protected private key to create a signature over that data, and associates the signature with the Code Signing Certificate. Verification can then inspect the signature, certificate chain and timestamp information and compare the signed data with the current artifact.
The private key is the security boundary in this process. The certificate can be distributed as part of the signature, but the private key should remain in the protected card or cloud signing environment.
Who Is Certum Standard Code Signing For?
Certum positions the Standard product for both individual developers and companies. The important decision is the publisher identity that needs to appear in the certificate and the software distribution model that identity represents.
Individual developer
Suitable when software is distributed under the developer's personal identity and the issuance requirements for an individual subscriber can be completed.
Software company
Suitable when applications are distributed under company information and the applicant can demonstrate the required authority and organization details.
Different Certum product
Qualifying open-source publishers have a dedicated Open Source product, while organizations needing the EV validation model should review Certum EV Code Signing.
What Identity Can Appear in the Certificate?
The certificate identity is part of what users and software platforms inspect when a signed file is verified. Accurate subscriber information therefore matters both during issuance and later when the signature is displayed to users.
Certum's current Standard specification allows certificate data to contain natural person data, natural person and organization data, or organization data only, according to the applicable subscriber model.
What the Standard Certificate Establishes
Code signing provides evidence about publisher identity, artifact integrity and the certificate trust path. These are related controls, but they should not be confused with a security audit or a guarantee about the quality of the software itself.
The certificate associates the signature with verified subscriber information and gives verification tools a publisher identity to inspect.
A valid signature allows a verifier to detect whether the signed content has changed after the signature was created.
The certificate can be evaluated through its issuing chain toward a trusted CA root available to the verification environment.
Publisher recognition and SmartScreen are related, not identical
Certum describes Standard Code Signing as eliminating the Unknown Publisher message and supporting the development of Microsoft SmartScreen reputation. That does not mean a newly signed application will never produce a SmartScreen warning. Reputation and application behavior remain separate parts of Microsoft's decision process.
What Certum Standard Code Signing Does Not Guarantee
A technically accurate product page should also define the boundaries of the certificate. The signature answers specific questions about publisher identity and artifact integrity, not every security question a user may have about an application.
Standard vs Open Source vs EV
These Certum products have different publisher models. The comparison is about eligibility and validation requirements, not a universal quality ranking.
Certum Standard Code Signing Certificate Requirements
Requirements vary according to whether the subscriber is an individual or an organization. The verification stage exists to establish the identity represented by the certificate and, for an organization certificate, confirm the applicant's authority to act for that organization.
How Certum Verifies the Subscriber
The issuance process moves from the commercial order to identity and organization checks before the certificate is activated. For an organization certificate, the validation must establish both the subscriber and the relevant organizational relationship.
Documents Required for Standard Code Signing
The exact evidence depends on the subscriber model and verification route. Certum currently recommends automatic identity verification where available, while registration and identity confirmation points remain documented alternatives.
Prepare the identity information and accepted documentation needed for the selected verification method.
Prepare organization details, representative information and evidence of authority where Certum requires it.
Automatic identity verification, Registration Point and Identity Confirmation Point are among the methods Certum documents.
How to Activate Certum Standard Code Signing
Activation is where the certificate order becomes a usable signing identity. The key pair and certificate must be configured inside the selected protected signing environment before a production release is signed.
Private Key Protection Is the Core Security Control
The certificate itself is not the secret. The private signing key is what allows a release to be signed as the publisher. If an attacker obtains that key, they may be able to create signatures that appear to originate from the legitimate certificate holder.
Card based protection
Certum's current Standard product documentation specifies cryptographic card storage and lists CC EAL6+ key storage. Card access is controlled through the card environment, including PIN and PUK management and the proCertum CardManager application.
The goal is to keep the signing key inside a controlled cryptographic device rather than exporting it as an ordinary private-key file.
Security incident boundary
A lost card, forgotten PIN and compromised private key are different events. Card management handles access to the device. Certificate revocation addresses a certificate that can no longer be trusted. If the private key is compromised, stop signing and begin the revocation and replacement process rather than continuing to use the affected credential.
Certum Standard Code Signing: Card vs Cloud
Certum currently offers Standard Code Signing through a physical cryptographic card and through the SimplySign cloud model. The choice changes how the signing environment is accessed and operated, while both models are designed to protect the signing key.
Cryptographic card
Uses a physical cryptoCertum card and compatible reader. This model is straightforward for a controlled workstation but introduces card, reader and physical access management into the signing process.
SimplySign cloud
Removes the physical card and reader from the workstation. It can simplify access for distributed development environments, while authentication, signing permissions and cloud access become part of the operational security model.
Which model fits?
Choose based on where releases are signed, who needs access, how automation is implemented and which protected key environment your release process can support.
SimplySign for Standard Code Signing
SimplySign is Certum's cloud approach to Code Signing. For Standard Code Signing, its practical difference is that the developer does not need to attach a physical card and reader to the signing workstation.
Where cloud signing changes the workflow
A card based process requires the signing environment to reach a physical cryptographic device. SimplySign replaces that physical dependency with a cloud signing environment and its authentication flow.
For teams, the decision should include access control, authentication, build server connectivity, release isolation and how signing credentials are handled in CI/CD.
Certum Standard Code Signing and Windows
Windows is one of the primary environments for Code Signing. Certum states that its Standard certificate is compatible with Microsoft Authenticode and supports common software artifacts such as EXE, MSI and DLL files, depending on the signing tool.
Windows signing lifecycle
The release artifact is built first, then signed with the protected private key. The certificate travels with the signature so Windows can inspect the publisher identity and certificate chain. A trusted timestamp can then preserve evidence of signing time for long lived releases.
Does Certum Standard Code Signing Remove SmartScreen Warnings?
Signing software and establishing SmartScreen reputation are related but not identical. Certum describes Standard Code Signing as supporting the building of Microsoft SmartScreen reputation rather than presenting a Code Signing Certificate as a permanent guarantee against SmartScreen warnings.
What the certificate contributes
The signature gives Windows a publisher identity and cryptographic evidence that the signed content has not changed since signing. Certum also states that signing can contribute to building Microsoft SmartScreen reputation.
What reputation still means
SmartScreen is a separate Microsoft security and reputation system. Newly signed software can still encounter warnings, and signing should not be marketed as a guaranteed SmartScreen bypass. Reputation can develop as software is distributed and evaluated over time.
Code Signing With a Certum Standard Certificate
The certificate becomes useful when it is integrated into the release lifecycle. Signing should happen after the final artifact is built and tested, because changing a signed file invalidates the signature over the changed content.
Timestamping and Long Term Signature Validity
A trusted timestamp adds evidence about when a signature was created. This matters because a Code Signing Certificate has a finite validity period, while software releases may remain available and installed long after the certificate itself expires.
Certum Standard Code Signing Certificate Validity in 2026
Certum's current shop documentation distinguishes the purchased product or service term from the validity period of each individual certificate. This distinction became particularly important from February 27, 2026.
Individual certificate validity
From February 27, 2026, a single Code Signing Certificate may be valid for a maximum of 459 days under Certum's current rules. This limits the validity of each issued certificate even when the customer purchases a longer product term.
Two and three year product terms
Certum continues to list 2 and 3 year Standard products. During those service periods, one or more free reissues are required so that each newly issued certificate remains within the current 459 day validity limit. The result is continued signing capability across the purchased service term rather than one certificate lasting the entire multi year period.
Certum Standard Code Signing Cost
Current Certum Shop listings show different starting prices depending on how the signing key is provisioned. The price of the certificate alone is therefore not the same as the total cost of a card based or cloud based signing setup.
The electronic code option is intended for customers who already have a compatible cryptographic card and reader. Card and SimplySign cloud variants are priced separately.
View Certum PricingPrice and availability can change
These are current starting prices from Certum's shop listings and should be checked immediately before purchase. The exact total depends on the selected term, card or cloud model and whether compatible hardware is already available.
What Happens When the Certificate Expires?
Certificate expiration affects the credential used for new signing operations. It should not be treated as the same event as the disappearance of a previously signed release. Timestamping, certificate status and the verification environment all matter when evaluating historical signatures.
Previously signed artifacts should be evaluated using their signature, certificate chain and any trusted timestamp evidence.
A new certificate or reissued certificate is required when the current credential can no longer be used for valid signing operations.
For multi year Certum products, reissue is part of the current validity model. Renewal is the lifecycle action used when the service period itself needs continuation.
What If the Private Key Is Lost or Compromised?
A lost card, forgotten PIN and compromised private key are different operational events. The response should be based on what has actually happened to the signing credential.
Certum Standard Code Signing for CI/CD
Automated signing can be incorporated into modern release pipelines, but the signing key should remain outside ordinary source code, build artifacts and plaintext pipeline variables. The signing stage should be isolated as a controlled release operation.
Signing should happen at the release boundary
Build, test and packaging jobs can remain broadly automated, while the final signing operation is restricted to the exact artifact intended for distribution. This reduces the number of systems that need access to the signing environment and makes incident investigation easier.
Supported Software and Signing Scenarios
Standard Code Signing is not a universal replacement for every platform's native signing system. The certificate is relevant where the platform accepts the applicable Code Signing certificate and signing format.
Certum Standard vs Certum EV
Both products support software signing, but their publisher and validation models differ. Select the product according to the identity and validation requirements of the distribution environment rather than treating one as a universal replacement for the other.
Standard vs Open Source vs EV: Which Product Model Fits?
Certum's product family separates these certificates by publisher model. This section is intended to clarify product boundaries rather than declare a universal preferred option.
Use this model when an individual developer or company needs standard publisher validation for general software distribution.
Use the dedicated Open Source product when the publisher is an individual who qualifies under Certum's public open-source project requirements.
Review EV when the organization and software distribution environment require the EV validation model and its additional verification requirements.
Certum Certificate Chain and Trust
A Code Signing Certificate is an end entity certificate. Verification also depends on the intermediate CA, root trust and the ability of the operating system or application to build a valid chain.
How to Verify a Certum Signed Application
Verification should look beyond the simple presence of a signature. Inspect the publisher identity, issuer, validity, signature algorithm, timestamp and certificate chain to understand what the signature actually establishes.
Windows GUI
Open the file properties, select Digital Signatures and open the signature details. This gives you a practical view of the signer and certificate information without requiring a command line.
Command line
SignTool can be used for signature verification in controlled Windows environments. PowerShell also provides signature inspection capabilities for supported files.
Common Certum Standard Code Signing Problems
Most operational problems occur around activation, key access, signing tool configuration or verification. Use the symptom to identify the right troubleshooting path rather than repeatedly reinstalling the certificate.
Is Certum Standard Code Signing Right for Your Signing Model?
A practical fit assessment should start with the publisher identity, software platform, key protection requirements and release workflow. The product is intended for standard Code Signing scenarios rather than every possible platform or certificate use case.
You are an individual developer or software company, need a verified publisher identity, distribute supported software such as Windows applications, require integrity verification and want a protected card or cloud signing environment.
You qualify specifically for Open Source Code Signing, require the EV validation model, or are signing a platform that uses a separate native certificate and distribution system.
Certum Standard Code Signing Buying Checklist
Complete the commercial and technical decisions before placing the order so the certificate can move directly into a controlled signing workflow after validation.
Frequently Asked Questions
Product specific answers for developers and companies evaluating Certum Standard Code Signing, including the 2026 validity model, Windows signing, cloud signing and lifecycle management.
What is Certum Standard Code Signing Certificate?
It is Certum's standard Code Signing product for individuals and companies that need a verified publisher identity and cryptographic signatures for supported software. It can be used with card based or SimplySign cloud signing models.
Who can buy Certum Standard Code Signing?
Certum positions Standard Code Signing for both individual subscribers and companies, subject to the applicable identity, organization and authorization requirements.
Can an individual developer get Certum Standard Code Signing?
Yes. Certum's Standard product is positioned for individuals as well as companies. The applicant must complete the applicable subscriber identity verification.
Can a company use Certum Standard Code Signing?
Yes. Company applicants must provide the applicable organization information and satisfy the verification requirements, including authority to represent the organization where required.
What name appears on a Certum Standard Code Signing certificate?
The certificate can contain natural person data, natural person and organization data, or organization data only under Certum's applicable subscriber model.
How does Certum verify a Standard Code Signing applicant?
Certum documents automatic identity verification as a recommended method, with Registration Point and Identity Confirmation Point options also available where applicable. Organization certificates require additional organization and representative checks.
What documents are required for Certum Standard Code Signing?
The required evidence depends on the subscriber model and verification route. Individual applicants need identity verification, while organization applicants may also need organization details and proof of authority to represent the organization.
How long does Certum Standard Code Signing take to issue?
Issuance time depends on the verification route, completeness of the supplied information and any organization checks. The current source material does not establish one universal issuance time for every applicant.
How much does Certum Standard Code Signing cost?
Current Certum Shop listings show Standard Code Signing from €139 for electronic code, €169 for the card set and €209 for the SimplySign cloud variant. Prices and availability can change.
How long is a Certum Standard Code Signing certificate valid?
From February 27, 2026, a single Code Signing certificate can have a maximum validity of 459 days under Certum's current rules. Standard products with 2 or 3 year service terms use reissues to maintain signing capability across the purchased period.
Why do Certum 2 year and 3 year products require reissues?
Certum states that a single Code Signing certificate is limited to 459 days from February 27, 2026. Longer Standard product terms therefore require one or more free reissues during the service period.
Can Certum Standard Code Signing be used with Windows Authenticode?
Yes. Certum's current Standard product documentation states compatibility with Microsoft Authenticode and lists common file types such as EXE, MSI and DLL depending on the signing tool.
Does Certum Standard Code Signing remove SmartScreen warnings?
Certum describes Standard Code Signing as supporting the building of Microsoft SmartScreen reputation. It should not be treated as a permanent guarantee that SmartScreen warnings will never appear.
Can Certum Standard Code Signing be used for EXE files?
Yes. EXE is among the file types listed by Certum for supported Code Signing workflows.
Can I use Certum Standard Code Signing for DLL files?
Yes. Certum lists DLL among supported file extensions, subject to the signing tool and platform workflow being used.
Can Certum Standard Code Signing be used in CI/CD?
It can be incorporated into CI/CD where the selected card or cloud signing environment supports the workflow. The private key should remain in a protected signing environment rather than being copied into ordinary build jobs.
Does Certum Standard Code Signing support cloud signing?
Yes. Certum currently offers Standard Code Signing in the Cloud through its SimplySign solution.
What is Certum SimplySign?
SimplySign is Certum's cloud based signing solution that removes the need for a physical card and reader at the signing workstation.
What happens if my Certum signing key is compromised?
Stop signing with the affected key, assess the incident, follow the certificate revocation process, generate a new protected signing key and obtain replacement credentials before resuming production signing.
Can I renew a Certum Standard Code Signing certificate?
Yes. Renewal is part of the certificate lifecycle. For multi year products, reissue is also part of the current 459 day certificate validity model.
Related Code Signing Resources
Continue with resources covering Certum's product family, Windows signing, certificate lifecycle and signature verification.
Certum Standard Code Signing connects publisher identity with signed software
The key decisions are the publisher identity, verification requirements, protected key model, software platform, certificate term and release workflow. Certum's 2026 validity rules also make reissue planning important for customers purchasing 2 or 3 year products.