GlobalSign EV Code Signing Certificate

Understand GlobalSign EV Code Signing, including enhanced organization validation, secure private-key options, Windows driver-signing requirements, pricing, certificate validity, and deployment workflows.

View Current Pricing →Compare OV vs EV

GlobalSign EV Code SigningEV

From $669 USD

Current listed starting price for EV Code Signing.

1 year

Organization validationToken or HSMTimestamping

ValidationExtended Validation

EligibilityRegistered organizations

Key protectionHardware-backed private key

Driver useWindows kernel-mode workflows

EV is required for access to the Windows Hardware Developer Center Dashboard for applicable kernel-mode driver signing workflows.

View GlobalSign EV Options →

Why Would an Organization Need GlobalSign EV?

The decision should start with the capability or validation requirement, not the label EV.

Normal application signing

Standard and EV can both support normal software signing. The relevant difference is the validation model and the requirements of the release environment.

Windows kernel-mode drivers

GlobalSign states that EV is required for access to the Windows Hardware Developer Center Dashboard used for the applicable kernel-mode driver workflow.

EV validation

Organizations that require the Extended Validation model go through the more rigorous EV vetting process.

Enterprise signing

EV should be evaluated together with token, HSM or supported cloud key-storage architecture rather than treated as a standalone security control.

Keep the trust claims separate

EV is not proof that software is malware-free.
EV is not a vulnerability or quality assessment.
EV does not mean Microsoft approves every signed application.

GlobalSign EV vs Standard Code Signing

This is the core product comparison: same organizational identity model, different validation level and EV-specific workflow requirements.

Requirement

GlobalSign Standard / OV

GlobalSign EV

Organization validation

Yes

Validation level

Standard

Extended Validation

Registered organization

Required

Normal software signing

Yes

Private-key protection

Token / HSM

Applicable Windows kernel-mode driver workflow

Not the EV requirement

EV required

Hardware Developer Center access

Not the EV requirement

EV required for applicable workflow

Timestamping

Supported

Current maximum validity

460 days

Compare GlobalSign EV with Standard Code Signing

Choose the validation level based on the signing workflow, publisher requirements and key protection model.

Compare OV and EV →

What GlobalSign EV Actually Establishes

Separate identity, integrity, trust and key-control functions so the buyer can understand what the certificate does.

Organization identity

GlobalSign validates the organization under the EV requirements and binds the certificate to that identity.

Software integrity

The digital signature gives a verifier evidence that the signed artifact has not been altered after signing.

Certificate trust

The certificate participates in the applicable GlobalSign CA hierarchy used by supported platforms.

Signing-key control

The protected private key creates the signature and must remain under controlled access.

What EV does not establish

The software is malware-free.
The software has no vulnerabilities or bugs.
The organization is trustworthy in every business context.
SmartScreen will automatically trust every newly signed application.

Who Can Apply for GlobalSign EV?

EV Code Signing is organization-oriented. The publisher identity must be a legally registered organization.

Legally registered organizationGlobalSign's current product information states that Code Signing certificates are issued in the name of a legally registered organization.

Organization legal nameThe certificate identity needs to represent the organization being validated.

Registered addressEV validation includes organizational information beyond the basic publisher name.

Authorized representativeThe application needs an appropriate person authorized to act for the organization.

Verification contactContact verification forms part of the validation workflow.

EV-specific vettingThe EV process applies stricter validation requirements than Standard Code Signing.

Identity boundary

This is not an individual or sole-proprietor product page. The certificate is designed around a legally registered organization and the EV identity associated with that organization.

The person who performs the signing can be a developer, release engineer or automated signing identity. That does not change the organization represented by the certificate.

What GlobalSign Verifies for EV

The EV process adds more rigorous organization vetting than Standard Code Signing.

Organization existenceEstablish the organization represented by the application.

Organization informationReview legal and organizational details, including address and jurisdiction information.

Authorized representativeConfirm the requester or representative associated with the organization.

Contact verificationComplete the required contact and validation checks.

EV approvalAfter the required vetting is completed, the certificate can proceed to issuance.

The useful distinction is that EV is not merely a different certificate label. The validation process is more rigorous, and the certificate is intended to provide stronger assurance about the publisher identity.

What You Should Prepare Before Applying

Prepare the organization records and signing architecture before starting the EV order.

Organization informationLegal name, registered address and organization contact details.

Authorized contactAuthorized representative and validation contact information.

Signing targetsSoftware types, platforms, signing tools and production signing locations.

Key protectionToken, customer-owned HSM or supported Azure Key Vault architecture.

Choosing the key-storage model early reduces provisioning changes later. A physical token, customer-owned HSM and cloud key-management environment create different signing and access patterns.

How GlobalSign EV Issuance Works

The EV lifecycle moves from organization validation into protected signing and final verification.

Order EV certificateStart the order through the GlobalSign Certificate Center or GlobalSign's purchase flow.

Submit organization informationProvide the identity and contact information required for EV validation.

Complete EV validationFinish the enhanced vetting and verification steps.

Provision key and certificateUse the selected token or HSM workflow to protect the signing key.

Sign, timestamp, verifyProduce a signed artifact and validate its certificate, chain and timestamp.

Important operational split

GlobalSign's support documentation separates ordering from installation and provides distinct token and HSM-based workflows. Certificate approval is therefore only one milestone. The signing environment still needs to be provisioned and tested before production release.

GlobalSign EV Private-Key Requirements

The certificate identifies the signer. The private key creates the signature. The protected device controls access to that private key.

EV CertificatePublisher identity and public-key information.

→

Protected Private KeyCryptographic secret used to create signatures.

→

Signed ArtifactSoftware carrying the digital signature.

The certificate and private key are different assets. The certificate can be distributed with the signed artifact and chain information. The private key should remain inside the selected protected signing environment.

GlobalSign EV With SafeNet Token

GlobalSign documents a token-based Code Signing workflow using a GlobalSign-provided SafeNet eToken.

GlobalSign EVValidated certificate representing the organization.

Token initializationPrepare the SafeNet device and required PIN/access controls.

Certificate installationInstall the issued certificate into the token-based environment.

SafeNet
protected
key

Signing clientSafeNet Authentication Client and the authorized signing environment.

Signing toolSignTool or the applicable platform signing utility accesses the credential.

Signed softwareThe final artifact receives the EV signature and timestamp.

The token workflow is practical for controlled signing environments. Its operational constraint is physical availability: the authorized signing machine needs access to the token when a production signature is created.

For frequent automated releases, organizations should evaluate whether a centralized HSM or supported cloud key architecture fits the release model better.

GlobalSign EV With an HSM

A customer-owned HSM moves the private-key boundary into enterprise cryptographic infrastructure.

HSM requirements and lifecycle

Compliant HSMGlobalSign's current EV HSM guidance requires a FIPS 140-2 Level 2 compliant HSM.

Key generationCreate the signing key inside the protected HSM environment.

CSR generationGenerate the certificate signing request from the HSM-held key.

Certificate pickupComplete the certificate pickup process after issuance.

Certificate importImport the certificate into the HSM environment.

Enterprise HSM signing path

Approved build
      |
      v
Signing request
      |
      v
Authorization
      |
      v
Customer HSM
  [private key]
      |
      v
Digital signature
      |
      v
Timestamp
      |
      v
Verification
      |
      v
Release

GlobalSign's current HSM guidance also documents a minimum 4096-bit key requirement for the documented CSR/key setup.

GlobalSign EV With Azure Key Vault

Azure Key Vault is key-protection infrastructure. It should not be described as a GlobalSign-operated cloud signing service.

CI/CDApproved build and release identity.

→

AuthorizationControlled permission to request signing.

→

Azure Key VaultProtected key operation under the customer's cloud environment.

GlobalSign's current product documentation identifies Azure Key Vault as a supported key-storage option. The important architectural distinction is who issues the certificate versus where the private key is protected.

Authentication, authorization, logging and release permissions remain the organization's responsibility. The build system should receive controlled access to a signing operation rather than an exportable copy of the private key.

Cloud signing controls

AuthenticationIdentify the approved build or release identity.

AuthorizationRestrict who can invoke production signing.

Key custodyKeep the private key inside the selected key-management boundary.

AuditRecord signing activity and production access.

GlobalSign EV for Windows Software

Windows application signing is a release pipeline: freeze the artifact, sign, timestamp, verify, then distribute.

Windows Authenticode release flow

Build
  |
  v
QA-approved EXE / DLL / MSI / CAB
  |
  v
Select EV certificate
  |
  v
Protected private-key operation
  |
  v
SignTool / Authenticode
  |
  v
Trusted timestamp
  |
  v
Verify signature + chain
  |
  v
Publish exact signed artifact

The artifact tested by QA should be the same artifact that receives the production signature.

GlobalSign lists Microsoft Authenticode among its supported signing environments. Common Windows targets include EXE, DLL and MSI files, with other Authenticode-compatible artifacts depending on the workflow.

Signing is not the end of the process. The release should verify publisher identity, certificate chain, signature status, timestamp and the final artifact before publication.

Internal resources can connect this product page to Windows Code Signing, Microsoft Authenticode, EXE signing and MSI signing guides.

GlobalSign EV for Windows Drivers

This is the key EV-specific workflow. EV certificate access and Microsoft driver approval are separate requirements.

Application signing

Normal Windows software can be signed with a trusted code-signing certificate according to the applicable user-mode requirements.

EV certificateEV is required to access the Windows Hardware Developer Center Dashboard for the applicable kernel-mode driver workflow.

Driver preparationPrepare the driver and complete the required Windows/Microsoft testing and submission requirements.

Hardware Developer CenterSubmit through Microsoft's driver-signing workflow where required.

Microsoft signing / approval pathFollow the applicable Microsoft process for the target Windows driver.

DistributionDistribute the driver according to the applicable Windows signing requirements.

Driver signing

Kernel-mode driver distribution introduces additional Microsoft requirements. The EV certificate is an access requirement, not a substitute for Microsoft's approval process.

Important distinction

Having a GlobalSign EV certificate does not mean Microsoft has approved the driver.
Hardware Developer Center access and the driver submission process are separate from certificate issuance.
Testing, HLK and other Microsoft requirements depend on the specific driver and target scenario.

GlobalSign EV + Java

Java signing uses the Java keystore and signing tools rather than Windows Authenticode.

KeystoreMake the EV certificate and protected key available to the Java signing environment.

Prepare JARFreeze the tested Java archive.

jarsignerApply the digital signature using the protected identity.

TimestampAdd the trusted timestamp required for the intended lifecycle.

VerifyCheck the JAR signature, certificate chain and timestamp.

Conceptual Java signing sequence

keytool
   |
   v
protected EV signing identity
   |
   v
jarsigner
   |
   v
signed-release.jar
   |
   v
timestamp + verification

GlobalSign EV + macOS

GlobalSign lists Apple/macOS among supported Code Signing platforms. The Apple-specific signing model still applies.

macOS signing layers

Signing identityMake the appropriate certificate and key available to the Apple signing environment.

Application bundlePrepare the exact application that will be distributed.

Apple signing workflowApply the platform's native signing and packaging requirements.

VerificationInspect the final signature and certificate information.

The EV certificate does not turn macOS signing into a Windows workflow. The certificate and protected key must be integrated with Apple's signing environment and the final package must satisfy Apple's requirements.

For a multi-platform organization, certificate governance can remain centralized while the actual signing tools and verification steps stay platform-specific.

GlobalSign EV + Timestamping

A digital signature and a timestamp answer different questions.

Digital signature

Which certificate signed the artifact?
Which organization is represented by the certificate?
Has the signed artifact changed?

Trusted timestamp

When was the signature created?
Was the signing certificate valid at that time?
Can the signature be evaluated later under applicable rules?

GlobalSign identifies timestamping as part of its Code Signing solution and describes it as supporting long-term validation after certificate expiration. The release system should therefore treat timestamp acquisition and timestamp verification as part of the signing workflow.

If timestamping fails, the release process should surface the failure rather than silently publishing an artifact whose intended long-term validation evidence is incomplete.

GlobalSign EV Certificate Chain

The chain connects the signed artifact to the trust anchor used by the verifying platform.

Signed softwareThe final application, installer, driver or other signed artifact.

GlobalSign EV Code Signing CertificateThe leaf certificate identifies the validated organization.

Intermediate CAThe issuing intermediate connects the leaf certificate to the root hierarchy.

GlobalSign RootThe root provides the trust anchor.

Trusted platformThe operating system or application evaluates the chain and signature.

A missing intermediate can create verification problems even when the leaf certificate itself is valid. Production releases should therefore be checked on a clean or controlled verification environment.

Inspect the chain

SubjectConfirm the publisher identity.

IssuerConfirm the issuing CA.

ValidityCheck the certificate dates.

ChainConfirm the intermediate and root path.

GlobalSign EV and SmartScreen

EV validation, code-signing trust and Microsoft SmartScreen reputation are separate layers.

EV validation: stronger publisher identity vetting

Code signature: identity + artifact integrity

Windows trust: certificate and chain validation

SmartScreen: Microsoft reputation and security signals

EV should not be presented as a guarantee that Windows SmartScreen will automatically trust a newly signed application. A valid EV signature provides publisher and integrity evidence, while SmartScreen uses broader Microsoft reputation and security signals.

This distinction is important when updating older code-signing content that may contain historical EV marketing claims about instant reputation or automatic warning removal.

GlobalSign EV Validity in 2026

The current certificate-lifecycle rules materially change renewal planning.

Previous model

Up to 39 months

Older Code Signing certificates could have multi-year validity.

26 Dec 2025

Longer issuance ended

GlobalSign stopped issuing 2-year and 3-year Code Signing certificates.

1 Mar 2026

460-day maximum

New Code Signing certificates are subject to the 460-day maximum.

Renewal planning

More frequent replacement

Existing certificates remain valid until expiry, while new and renewed certificates follow the current rules.

Do not confuse a purchased term with the validity of an individual certificate. GlobalSign's current shop states that newly issued certificates are 1-year certificates, while renewals can reach up to 460 days in circumstances where remaining validity is carried forward.

GlobalSign EV Pricing

The certificate price is only one part of the EV signing budget.

Current listed starting price

$669

USD / year

GlobalSign's current official code-signing page lists EV Code Signing from $669 USD per year. Pricing can change by region and product configuration.

View GlobalSign EV Options →

CertificateFrom $669/year

TokenHardware token and administration

Customer HSMHSM infrastructure and integration

Azure Key VaultCloud infrastructure and signing integration

OperationsValidation, release controls, monitoring and administration

RenewalRecurring certificate replacement and testing

The realistic cost model combines the certificate with key protection, signing infrastructure, CI/CD integration, administration and renewal work. A token-based workstation and an enterprise HSM-backed signing service have different operational costs even though both use an EV certificate.

Review GlobalSign EV product details

Confirm current product eligibility, validation requirements and pricing directly with GlobalSign before ordering.

View official EV details →

GlobalSign EV Renewal

Treat renewal as a controlled replacement event rather than an administrative date.

90 days before expirationGlobalSign's current renewal guide says the Renew option becomes available within 90 days before expiry.

Confirm organization informationReview the organization identity and renewal details.

Complete required validationFollow the applicable EV renewal and validation steps.

Issue the new certificateProvision the replacement certificate into the selected signing architecture.

TestSign a controlled artifact, timestamp it and verify the complete result.

Update productionUpdate the signing pipeline and move production signing to the new certificate.

Renewal window

The current GlobalSign guide states the Renew button is available within 90 days before expiration and 7 days after expiration.
Changing organization information requires a new order rather than a straightforward renewal.

What Happens If the EV Private Key Is Compromised?

A suspected private-key compromise requires immediate control of the signing authority.

Stop signingPause manual and automated signing using the affected credential.

Determine scopeIdentify where the key was accessible and which releases may be affected.

RevokeStart the applicable certificate revocation process.

Generate new keyCreate a fresh protected signing key and complete required validation/reissue.

RecoverProvision the replacement, update CI/CD and review affected releases.

Replacing only the visible certificate is not enough if the private key itself was compromised. The replacement must use a fresh protected key and a controlled signing environment.

GlobalSign EV in CI/CD

Automation should receive controlled access to a signing operation, not an exportable copy of the private key.

Three deployment models

Token
Build
  |
  v
Authorized signing machine
  |
  v
Protected token
  |
  v
Signature

HSM
Build
  |
  v
Signing integration
  |
  v
Customer HSM
  |
  v
Signature

Azure Key Vault
Build
  |
  v
Controlled signing operation
  |
  v
Key Vault
  |
  v
Signature

AuthenticationIdentify the approved release identity.

AuthorizationLimit who or what can invoke production signing.

Key isolationKeep the private key inside the protected environment.

Release approvalControl the transition from build output to production signing.

TimestampingMake timestamping part of the automated signing path.

VerificationVerify signature, chain and timestamp before publishing.

Expiry monitoringTrack the certificate lifecycle before it blocks a release.

Audit loggingRecord production signing activity and access.

Plan protected signing for automated releases

Assess token, HSM and supported cloud key options before integrating production signing into your release pipeline.

Explore cloud code signing →

GlobalSign EV vs Other EV Providers

A factual comparison of certificate category, driver-signing context, key options and current validity.

Provider

EV / driver context

Key options / current validity

GlobalSign

EV required for applicable Windows Hardware Developer Center workflow

Token / HSM / Azure Key Vault; 460-day maximum

DigiCert

EV available; current driver requirements should be checked

KeyLocker / HSM options; current rules apply

Sectigo

EV available; current driver requirements should be checked

Current token/cloud options; current rules apply

SSL.com

EV available; current driver workflows should be checked

eSigner / HSM options; current rules apply

The purpose of this table is to map product attributes, not to rank providers. Pricing, issuance requirements, supported storage models and platform rules can change and should be verified against each provider's current documentation before purchase.

When GlobalSign EV May Not Be Necessary

Use the actual signing requirement to decide whether Standard or EV belongs in the architecture.

Standard Windows application distribution

Compare Standard and EV based on the organization's validation requirement and the actual Windows application workflow.

Kernel-mode driver workflow

EV becomes relevant because of the applicable Microsoft and GlobalSign requirements for the Windows Hardware Developer Center workflow.

Enterprise signing

Compare both products together with the organization's token, HSM or cloud key-management architecture.

Individual publisher

GlobalSign EV is organization-oriented and requires a legally registered organization.

GlobalSign EV Buying Checklist

Confirm the certificate, driver workflow and signing architecture before ordering.

Legally registered organizationConfirm the applicant identity meets the organization requirement.

EV validation contactHave the authorized representative and validation contact available.

Signing targetsList Windows, drivers, Java, macOS and other required platforms.

Driver requirementConfirm whether the project needs the Windows Hardware Developer Center workflow.

Key architectureSelect token, customer HSM or supported Azure Key Vault model.

Private-key controlsDocument signing access, authentication and authorization.

TimestampingPlan timestamp acquisition and verification.

CI/CD workflowTest controlled production signing before release.

Expiry monitoringTrack the 460-day maximum and renewal window.

Renewal ownerAssign responsibility for replacement and production testing.

Compromise procedureDocument revocation, fresh-key generation and release review.

GlobalSign EV Code Signing FAQ

Product-specific answers covering EV validation, driver signing, key protection, platforms, pricing and lifecycle.

What is a GlobalSign EV Code Signing Certificate?

It is GlobalSign's Extended Validation Code Signing product for legally registered organizations. It adds EV validation requirements and is required for access to the Windows Hardware Developer Center Dashboard for the applicable kernel-mode driver workflow.

Who can get GlobalSign EV Code Signing?

GlobalSign's current product information states that its Code Signing certificates are issued in the name of a legally registered organization. EV also requires the additional validation associated with the EV process.

What does GlobalSign verify for EV?

The EV process includes verification of the organization and additional organizational information, authorized representation and contact information under the applicable EV requirements.

What is the difference between GlobalSign EV and Standard Code Signing?

Standard uses standard organization validation. EV uses Extended Validation and is required for access to the Windows Hardware Developer Center Dashboard for the applicable kernel-mode driver signing workflow.

Does GlobalSign EV require a registered organization?

Yes. The product is organization-oriented and requires a legally registered organization.

Is GlobalSign EV required for Windows kernel-mode drivers?

GlobalSign states that EV is required to access the Windows Hardware Developer Center Dashboard through which applicable kernel-mode drivers must be signed.

Is GlobalSign EV required for Windows Hardware Developer Center access?

Yes for the applicable code-signing workflow. GlobalSign states that EV Code Signing is required to access the Windows Hardware Developer Center Dashboard.

Does EV automatically improve SmartScreen reputation?

No certificate should be presented as a guarantee of SmartScreen reputation. EV provides stronger identity validation, while SmartScreen uses broader Microsoft reputation and security signals.

Does GlobalSign EV require a hardware token?

GlobalSign's EV product information states that the certificate is stored on a hardware token, and GlobalSign also documents HSM-based EV Code Signing workflows.

Can I use my own HSM?

Yes. GlobalSign documents customer-owned HSM deployment for EV Code Signing and currently requires a compliant HSM for the HSM-based EV workflow.

Can I use Azure Key Vault?

GlobalSign's current product documentation identifies Azure Key Vault as a supported key-storage option for its Code Signing products.

Can GlobalSign EV be used in CI/CD?

Yes, when the CI/CD system has controlled access to the protected signing operation. The architecture can use a token, HSM or supported Azure Key Vault model.

Can GlobalSign EV sign EXE files?

Yes. GlobalSign lists Microsoft Authenticode among its supported Code Signing platforms and use cases.

Can it sign DLL and MSI files?

Microsoft Authenticode supports common Windows application artifacts such as DLL and MSI files, subject to the exact signing workflow.

Can GlobalSign EV sign Java JAR files?

Yes. GlobalSign lists Java among its supported Code Signing platforms.

Can GlobalSign EV sign macOS software?

GlobalSign lists Apple/macOS among its supported Code Signing platforms. The implementation must follow Apple's platform requirements.

Does GlobalSign EV support timestamping?

Yes. GlobalSign's EV product material identifies timestamping as part of the Code Signing solution and explains its role in maintaining validity after certificate expiration.

How long is GlobalSign EV valid in 2026?

The current maximum validity for EV Code Signing is 460 days. GlobalSign's current shop states that newly issued certificates are 1-year certificates, while renewal circumstances can allow up to the 460-day maximum.

How much does GlobalSign EV Code Signing cost?

GlobalSign's current official Code Signing page lists EV Code Signing from $669 USD per year. Pricing can vary by region and configuration.

How does GlobalSign EV renewal work?

GlobalSign's current renewal guide says the Renew option becomes available within 90 days before expiration and up to 7 days after expiration. Changes to organization information require a new order.

What happens if the EV private key is compromised?

Stop signing, determine scope, revoke the certificate, generate a fresh protected key, complete required validation or reissue, provision the replacement and review affected releases.

Related Resources

Connect the EV page to the surrounding CodeSigningSolution certificate, platform and lifecycle content.