DigiCert KeyLocker Code Signing
DigiCert KeyLocker moves the Code Signing private key into a DigiCert managed cloud HSM, so signing can happen without keeping a physical USB token attached to a developer workstation or build server.
Code Signing + KeyLocker
What DigiCert KeyLocker Actually Changes
KeyLocker is not a new certificate validation type. It changes the way the private signing key is stored and accessed. Your Code Signing certificate can be standard organization validated Code Signing or EV Code Signing, while KeyLocker provides the cloud based key protection and signing environment.
Traditional token model
A private key is held on a physical cryptographic token. Signing requires the token to be available to the signing environment.
This can be practical for controlled manual signing, but becomes less convenient when releases are automated or distributed across remote environments.
KeyLocker model
The private key is generated and stored inside DigiCert's managed cloud HSM. Authorized signing requests can use the protected key without exporting it to the developer's machine or build server.
That makes the model better suited to remote signing and automated release workflows.
DigiCert KeyLocker Pricing
These are the current prices provided in the supplied DigiCert research. The $996 figure is the primary commercial price for standard Code Signing + KeyLocker.
12 month auto renewing subscription with KeyLocker.
12 month EV Code Signing + KeyLocker configuration.
Each additional 1,000 signatures.
Compare DigiCert Code Signing Options
Review the available DigiCert certificate products and confirm the configuration that matches your validation and key storage requirements.
Explore DigiCert certificatesWhat the $996 KeyLocker Package Includes
The annual price is more than the certificate alone. It combines Code Signing with cloud based key storage and signing infrastructure.
1,000 Signatures Are Included
DigiCert's current KeyLocker licensing model counts signing operations against a signature allowance. A batch containing 100 files still consumes 100 signature units when 100 files are signed.
| Signing capacity | Price | How to interpret it |
|---|---|---|
| Included with certificate | 1,000 signatures | Included in the annual KeyLocker certificate |
| Additional 1,000 | $249 | One additional 1,000 signature unit |
| Additional 2,000 | $498 | Two additional 1,000 unit purchases |
| Additional 3,000 | $747 | Three additional 1,000 unit purchases |
The $498 and $747 figures are calculated from the documented $249 price per additional 1,000 signatures, not separate published package prices.
Private Key Stays in the Cloud HSM
KeyLocker is designed around protected remote signing rather than moving a PFX file or private key between machines.
- DigiCert managed cloud HSM
- FIPS 140-2 Level 3 compliant key storage
- Private key is not downloaded to the signing workstation
- Two factor authentication for KeyLocker users
- Signing performed through authorized KeyLocker workflows
When KeyLocker Makes More Sense Than a USB Token
The strongest reason to choose KeyLocker is workflow convenience and protected remote signing, not a change in certificate validation.
CI/CD Pipelines
Signing can become part of an automated build and release pipeline without connecting a physical token to the build server.
Remote Development Teams
Teams can use a cloud based signing environment rather than physically transferring a signing token between locations.
Small Software Teams
The service can provide managed key protection without requiring the team to operate its own HSM infrastructure.
Individual Developers
KeyLocker can be useful when one developer needs protected signing access from multiple environments.
Automated Releases
Build, package and sign stages can be connected without placing the private key on the build machine.
Moderate Signing Volume
The included 1,000 signatures make the product relevant for teams whose annual signing volume fits the current allowance.
One Assigned Signer Per Certificate
KeyLocker is not an unrestricted shared certificate account. Under the current licensing model, one signer can be assigned to a Code Signing certificate at a time.
From Certificate Order to Signed Release
KeyLocker becomes part of the signing process after the certificate is ordered through DigiCert CertCentral.
Order the certificate
Start the Code Signing subscription through DigiCert CertCentral and select the supported KeyLocker provisioning method.
Generate the key pair
KeyLocker generates the private key pair inside the protected cloud environment rather than on the developer's machine.
Complete validation
DigiCert completes the validation required for the underlying Code Signing certificate.
Activate KeyLocker
The certificate and protected key become available through the KeyLocker environment.
Connect signing tools
Use SMCTL or supported third party signing tools to submit authorized signing operations.
Authenticate
KeyLocker requires two factor authentication for its users and signing activity.
KeyLocker Signing Tools
DigiCert provides its own command line tooling and also supports selected third party signing tools.
SMCTL
Signing Manager Controller CLI is DigiCert's recommended command line interface for signing with KeyLocker. It can be used for direct signing and different signing workflows.
Third Party Signing Tools
DigiCert supports selected third party signing tools with KeyLocker while keeping the private key protected in the cloud environment. This can reduce the need to redesign an existing signing workflow.
KeyLocker vs USB Token vs HSM
| Feature | USB Token | DigiCert KeyLocker | Customer HSM |
|---|---|---|---|
| Private key location | Physical token | DigiCert cloud HSM | Customer controlled HSM |
| Physical hardware required | Yes | No | Yes |
| Remote signing | Limited | Yes | Depends on architecture |
| CI/CD automation | More complex | Designed for automation | Yes |
| Key export | Protected | Protected in cloud HSM | Protected in HSM |
| Physical token loss risk | Yes | No physical token | Infrastructure dependent |
| Signing allowance | Certificate dependent | 1,000 included | Architecture dependent |
| Best fit | Manual signing | Remote and automated signing | Enterprise signing infrastructure |
KeyLocker Does Not Define Certificate Validation
This distinction should be clear on the commercial page. KeyLocker is the storage and signing environment. The underlying certificate still has its own validation level.
Standard Code Signing + KeyLocker
Current supplied pricing: $996/year. The underlying certificate uses standard organization validation.
EV Code Signing + KeyLocker
Current supplied pricing: $1,272/year. The underlying certificate uses Extended Validation.
What Can You Sign With KeyLocker?
KeyLocker is the key management and signing infrastructure. The actual supported formats depend on the underlying Code Signing certificate and the signing tools being used.
Windows EXE
Use supported Windows signing workflows to sign executable software.
DLL
Sign supported Windows libraries as part of your software release process.
MSI and Installers
Integrate signing into installer packaging and release workflows.
Java JAR
Use appropriate Java signing tools with the protected signing environment.
PowerShell
Use supported PowerShell Code Signing workflows.
CI/CD Artifacts
Automate signing as part of your build, package and release pipeline.
KeyLocker vs Software Trust Manager
DigiCert positions these products for different levels of signing governance and scale.
| KeyLocker | Software Trust Manager | |
|---|---|---|
| Target | Individual developers and small teams | Larger organizations |
| Key storage | Cloud HSM | Centralized signing platform |
| Signer model | One assigned signer per certificate | Shared governance |
| Signature limits | 1,000 per certificate initially | Designed for broader scale |
| Role based access | Limited | Yes |
| Policy controls | Basic | Advanced |
| Audit and governance | Basic | Advanced |
| CI/CD | Yes | Yes |
| Multiple teams | Less suitable | Better suited |
KeyLocker Does Not Change Certificate Validity
KeyLocker is the storage and signing environment. The validity of the public Code Signing certificate still follows the applicable certificate rules.
Plan Your Code Signing Workflow
Check how protected signing can fit into your release pipeline before choosing a certificate and signing service.
Review CI/CD signing guidanceDigiCert KeyLocker Questions
What is DigiCert KeyLocker?
DigiCert KeyLocker is a cloud based key storage and Code Signing service that stores Code Signing private keys in a DigiCert managed cloud HSM.
How much does DigiCert KeyLocker Code Signing cost?
The current supplied DigiCert price for Code Signing + KeyLocker is $996 for 12 months.
How much does EV Code Signing with KeyLocker cost?
The current supplied DigiCert price is $1,272 for 12 months.
How many signatures are included?
Each KeyLocker Code Signing certificate currently includes 1,000 signatures.
What happens when I use all 1,000 signatures?
Additional signature units can be purchased in increments of 1,000. The current supplied price is $249 per additional 1,000 signatures.
Can multiple developers use one KeyLocker certificate?
Under the current licensing model, one signer can be assigned to a certificate at a time. The assigned user can be changed by the KeyLocker Lead.
Is KeyLocker a Code Signing certificate?
No. KeyLocker is the cloud key storage and signing service. The Code Signing certificate still has its own validation type, such as standard organization validated Code Signing or EV Code Signing.
Is DigiCert KeyLocker an HSM?
KeyLocker uses a DigiCert managed cloud HSM for private key storage and signing. DigiCert describes it as FIPS 140-2 Level 3 compliant.
Can I use KeyLocker with CI/CD?
Yes. DigiCert provides KeyLocker integrations and documentation for CI/CD and deployment pipelines.
Can I use SignTool with DigiCert KeyLocker?
Supported third party signing tools can interact with KeyLocker while the private key remains protected in the KeyLocker environment.
Does KeyLocker require two factor authentication?
Yes. DigiCert requires 2FA for KeyLocker users, including signing and certain DigiCert ONE actions.
Is KeyLocker better than a USB token?
It depends on the workflow. A USB token can work well for manual signing from a controlled workstation. KeyLocker is more convenient when signing needs to be remote or integrated into automated build and release pipelines.
DigiCert KeyLocker Code Signing
$996/year for standard Code Signing + KeyLocker, with 1,000 included signatures and DigiCert managed cloud HSM key protection.
Check Current DigiCert Pricing →