DigiCert EV Code Signing Certificate
Give software publishers an Extended Validation Code Signing option designed for organizations that need EV level validation or specific signing requirements, including applicable Microsoft Windows driver workflows.
Starting price for DigiCert EV Code Signing using your own compliant hardware token or HSM. Prices are subject to change.
Check Current DigiCert Pricing →What Is DigiCert EV Code Signing?
The DigiCert EV Code Signing Certificate provides Extended Validation for organizations publishing software. It is designed for software publishers that need a higher validation level or specific platform requirements.
DigiCert's current documentation identifies EV Code Signing separately from standard Code Signing and requires the organization to complete the applicable EV Code Signing validation. DigiCert supports EV Code Signing with hardware tokens, HSMs and DigiCert KeyLocker.
Extended Validation
DigiCert EV Code Signing requires the organization to complete the applicable EV validation process before issuance.
Verified Publisher Identity
The signature associates software with the validated organization that signed it, helping establish publisher identity.
Hardware Protected Key
DigiCert requires private keys for public EV Code Signing certificates to use compliant hardware protection.
Timestamping
Timestamping is supported so signatures can remain verifiable after certificate expiry when the signature and timestamp remain valid.
Windows Driver Workflows
EV is particularly relevant for applicable Microsoft Windows driver signing and attestation workflows.
CI/CD Compatibility
DigiCert lists integrations and environments including Azure DevOps, CircleCI, GitLab and Jenkins.
DigiCert EV Code Signing Price
The price depends on how the private key is provisioned and stored. The main product price should be presented as the starting configuration rather than implying every deployment has the same cost.
| EV configuration | Current DigiCert price | Best suited for |
|---|---|---|
| EV + Own Token | $972 / year | Organizations with their own compliant signing hardware |
| EV + HSM | $972 / year | Enterprise and centralized signing infrastructure |
| EV + DigiCert USB Token | $1,116 / year | Organizations needing DigiCert supplied hardware |
| EV + KeyLocker | $1,272 / year | Cloud based signing and automated release workflows |
Considering cloud based code signing?
Compare how managed key storage and remote signing work before choosing a KeyLocker configuration for your release pipeline.
Explore DigiCert KeyLockerDigiCert EV Code Signing Key Storage Options
EV defines the validation level. The provisioning method determines how the private key is protected and how signing is integrated into your workflow.
Use Your Own Hardware Token
Use your own supported compliant cryptographic token when your organization already has suitable signing hardware.
This keeps the private key protected by hardware while using the standard EV subscription configuration.
DigiCert USB Token
DigiCert can provide the hardware token with the EV subscription for organizations that need supplied signing hardware.
The private key remains protected by the hardware instead of being provided as an ordinary downloadable key.
HSM
Organizations with centralized signing infrastructure can use an HSM for controlled key access and automated signing.
This can be more appropriate for enterprise release environments with multiple signing processes.
DigiCert KeyLocker
KeyLocker provides cloud based key storage and signing through DigiCert's platform.
DigiCert's current documentation states that each KeyLocker certificate includes 1,000 signatures, with additional signature units available for purchase.
DigiCert EV Code Signing Certificate Specifications
- Certificate typeEV Code Signing
- ValidationExtended Validation
- Starting price$972 / year
- Own token$972 / year
- HSM$972 / year
- DigiCert USB token$1,116 / year
- KeyLocker$1,272 / year
- Subscription12 months, auto renewing
- Maximum public certificate validity459 days
- Private key protectionRequired
- Hardware standardFIPS 140 Level 2 / Common Criteria EAL4+ or equivalent
- ManagementDigiCert CertCentral
- TimestampingSupported
- Windows driver workflowsEV compatible with applicable Microsoft requirements
- CI/CD integrationsSupported
DigiCert EV Code Signing Validation
EV Code Signing requires the organization to complete DigiCert's EV validation process before the certificate can be issued.
The current DigiCert workflow includes:
- Organization validation
- Verified contact
- Appropriate authorization to request the certificate
- Approval of the certificate request
- DigiCert verification of the organization and contact information
DigiCert states that it contacts a verified telephone number for the organization to confirm authority to order and that the certificate remains pending until the required validation and approval steps are completed. Avoid promising a fixed issuance time because validation can take longer when DigiCert cannot immediately verify the organization or contact information.
DigiCert EV Code Signing Certificate Validity
Current certificate validity is important because older Code Signing pages often still show outdated multi year certificate terms.
459 day maximum: As of February 24, 2026, DigiCert's maximum validity for public Code Signing and EV Code Signing certificates is 459 days.
No new two or three year public certificates: DigiCert no longer issues new two or three year public Code Signing certificates.
A customer can have a subscription or purchase arrangement that spans a longer period, but an individual public certificate cannot exceed the current 459 day validity limit.
DigiCert EV Code Signing for Windows Drivers
Windows driver signing is one of the strongest practical reasons an organization may consider the EV product.
Microsoft driver signing: DigiCert currently describes EV Code Signing as compatible with Microsoft attestation signing requirements.
For organizations developing Windows drivers, the signing workflow has requirements that differ from ordinary application signing.
Important: Do not state that every Windows driver must use EV without qualification. Verify the current Microsoft and DigiCert requirements for the specific driver workflow before selecting the certificate.
Supported DigiCert EV Signing Environments
DigiCert lists compatibility with a broad range of development and signing environments.
Microsoft Authenticode
Sign supported Windows applications and binaries using the Authenticode workflow.
View Authenticode guide →Kernel Mode
EV Code Signing supports applicable Windows kernel mode signing requirements.
Apache Ant, Maven and Gradle
DigiCert lists these build environments among its supported signing integrations.
Azure DevOps, CircleCI, GitLab and Jenkins
Supported CI/CD environments can integrate signing into automated release workflows.
View CI/CD guide →SignTool
Use supported Microsoft signing tooling for applicable Windows signing workflows.
View SignTool guide →PowerShell
Supported PowerShell scripts can be signed using appropriate Code Signing workflows.
View PowerShell guide →How DigiCert EV Code Signing Works
The EV signing process combines your software, a protected private key, the DigiCert certificate and a trusted timestamp.
DigiCert EV vs Standard Code Signing
EV is not automatically the right choice for every software publisher. Compare the validation level, price and workflow requirement before ordering.
| Feature | DigiCert Standard Code Signing | DigiCert EV Code Signing |
|---|---|---|
| Validation | CS Organization Validation | Extended Validation |
| Organization verification | Yes | Yes |
| EV validation | No | Yes |
| Starting price | $696/year | $972/year |
| Own token / HSM | Yes | Yes |
| DigiCert USB token | $840/year | $1,116/year |
| KeyLocker | $996/year | $1,272/year |
| Maximum validity | 459 days | 459 days |
| Windows driver requirements | Depends on workflow | EV compatible with applicable requirements |
Important: Do not market EV simply as "more trusted." The practical reasons to choose EV should be tied to the additional validation and specific signing requirements that apply to the organization.
DigiCert EV Code Signing vs KeyLocker
These are not competing certificate types. EV defines the validation level, while KeyLocker defines how the private key is stored and how signing is performed.
EV + USB Token
EV validation combined with DigiCert supplied hardware. Current price: $1,116/year.
EV + Own Token
EV validation using your own compliant token. Current price: $972/year.
EV + HSM
EV validation with centralized hardware security infrastructure. Current price: $972/year.
EV + KeyLocker
EV validation with cloud based key storage and signing. Current price: $1,272/year.
KeyLocker Signing Units
DigiCert's current documentation states that each KeyLocker certificate includes 1,000 signatures, with additional signature units available for purchase.
Automated Signing
HSM and KeyLocker configurations can be particularly relevant where signing needs to be integrated into automated release infrastructure.
Who Should Choose DigiCert EV Code Signing?
Software Companies
Organizations distributing commercial software can use EV when their requirements justify the additional validation.
Enterprise Software Publishers
Large organizations can combine EV Code Signing with HSM or KeyLocker based on their internal signing architecture.
Windows Driver Developers
EV is particularly relevant where the applicable Microsoft driver signing workflow requires or supports EV Code Signing.
Organizations With Centralized Signing
Teams with automated release infrastructure can consider HSM or KeyLocker instead of relying on a physical USB token for every signing operation.
Who May Not Need DigiCert EV?
You may not need EV simply because you publish commercial software.
If your primary requirements are verified organization identity, software integrity, Authenticode signing, standard application signing, installer signing or CI/CD signing, standard DigiCert Code Signing may be sufficient.
The current standard Code Signing price starts at $696/year, compared with $972/year for EV using your own token or HSM. Choose EV when the additional validation or a specific signing workflow justifies it.
Does EV Guarantee SmartScreen Trust?
No. Do not use "EV removes SmartScreen warnings" as a product claim.
Code signing establishes publisher identity and software integrity, but Windows reputation systems can consider other signals. Older Code Signing content can make stronger SmartScreen claims than current platform behavior supports.
DigiCert EV Private Key Protection
DigiCert's current requirements require public Code Signing and EV Code Signing private keys to be protected using compliant hardware.
| Provisioning method | Suitable for |
|---|---|
| Own supported token | Developers and teams with existing compliant hardware |
| DigiCert USB token | Customers who need DigiCert supplied hardware |
| HSM | Enterprise and centralized signing infrastructure |
| KeyLocker | Cloud based signing and automated workflows |
DigiCert states that it does not accept certificate requests where the private key is generated in a browser or installed directly on a laptop or server.
Frequently Asked Questions
What is DigiCert EV Code Signing Certificate?
It is DigiCert's Extended Validation Code Signing certificate for organizations that need EV level publisher validation or specific signing requirements.
How much does DigiCert EV Code Signing cost?
The current official DigiCert price starts at $972 for a 12 month subscription when using your own compliant token or HSM.
How much is DigiCert EV Code Signing with a USB token?
DigiCert currently lists $1,116 for 12 months when using the DigiCert supplied USB token configuration.
How much is DigiCert EV Code Signing with KeyLocker?
DigiCert currently lists $1,272 for 12 months for EV Code Signing + KeyLocker.
Can I use my own HSM with DigiCert EV Code Signing?
Yes. DigiCert currently lists an EV + HSM configuration at $972/year.
Does DigiCert EV Code Signing require hardware key protection?
Yes. DigiCert requires private keys for public Code Signing certificates to be stored on hardware meeting its stated security requirements.
How long is a DigiCert EV Code Signing Certificate valid?
The current maximum validity for a public DigiCert EV Code Signing certificate is 459 days. DigiCert stopped issuing new two and three year public Code Signing certificates from February 24, 2026.
Is DigiCert EV better than standard Code Signing?
Not automatically. EV provides a higher validation level and may be required for particular signing workflows. If you only need organization validated software signing, standard DigiCert Code Signing may be sufficient.
Is DigiCert EV required for Windows drivers?
EV is compatible with Microsoft's applicable attestation signing requirements, and DigiCert specifically highlights EV for Microsoft Windows driver signing. Always verify the current Microsoft requirements for your specific driver workflow.
Can DigiCert EV Code Signing be used in CI/CD?
Yes. DigiCert lists integrations with environments including Azure DevOps, CircleCI, GitLab and Jenkins. KeyLocker and HSM based configurations can be particularly relevant for automated signing.
Compare DigiCert signing options before you buy
Review DigiCert’s certificate range and compare standard, EV and KeyLocker options against your validation, key protection and release workflow requirements.
Explore DigiCert certificate options