HARICA IV Code Signing Certificate

Sign software under a verified individual publisher identity and let users and platforms verify who signed the code. This guide covers Individual Validation, identity verification, mandatory hardware key protection, Windows and Java signing, SmartScreen distinctions, certificate lifecycle, CI/CD architecture and the difference between IV, OV and EV.

Visit HARICA

Individual Validated

From €59 HARICA listed starting price

ValidationIndividual Validation

Publisher identityNatural person

Windows signingSupported

Java signingSupported

Key protectionHardware required

Security baselineFIPS 140-2 L2 / CC EAL4+

IVIndividual Validated publisher identity

Natural personIdentity represented in the certificate

HardwareProtected private key required

Windows + JavaCore signing scenarios listed by HARICA

What Is HARICA IV Code Signing?

HARICA IV means Individual Validated Code Signing. The certificate contains information that identifies a natural person as the software publisher. The signature then connects the signed software to that validated publisher identity while providing a mechanism for verifying whether the signed content was changed after signing.

Individual publisher model

The defining difference is who the certificate identifies. IV is designed around an individual publisher rather than a legal entity. That distinction affects the certificate subject, validation process and the identity users can inspect when viewing a signature.

Natural personIdentity validationPublisher identityCode signature

Technical trust path

Publisher: validated individual
Certificate: HARICA Code Signing IV
Public key: used for verification
Signature: applied to release artifact
Chain: certificate path to trusted CA

Who Is HARICA IV Code Signing For?

Individual software developers

Developers distributing applications, utilities, tools, libraries or executable software under their own identity.

Independent software publishers

People publishing software without using a registered company identity as the publisher.

Freelance developers

Where the software is legitimately published under the individual's identity and the HARICA requirements can be met.

The boundary

Individual publisher → IV. Legal entity publisher → OV or EV. The distinction is the publisher identity, not simply the price of the certificate.

What Does Individual Validated Mean?

Individual Validation identifies the certificate subscriber as a natural person. HARICA's certificate policy uses IVCP for its Individual Validation Certificate Policy and associates the validation model with the applicable Code Signing policy framework.

Natural personThe applicant is treated as an individual publisher.

IdentityPersonal information must match the identity evidence submitted.

SubscriberThe certificate request is tied to the verified subscriber.

CertificateThe issued certificate represents the individual publisher.

What Identity Appears in a HARICA IV Certificate?

When inspecting a signed application, the certificate provides identity and trust information that can be reviewed by the user or verification software. The exact certificate subject should be read from the issued certificate rather than copied from an example.

Typical inspection fields

Subject → individual publisher information
Issuer → issuing CA
Validity → certificate dates
Policy → certificate policy identifiers
Signature → cryptographic signature details
Chain → issuing path and trust anchors

What to verify

Publisher identity
Certificate validity
Issuer and chain
Signature status
Timestamp information
Certificate policy information

What Does HARICA IV Code Signing Establish?

IdentityPublisher identityThe signature associates the software with the validated individual.

IntegritySoftware integrityVerification can detect changes made after the signed content was created.

AuthenticitySignature authenticityThe signature can be checked against the corresponding public key.

TrustCertificate trustThe certificate can be evaluated through its certificate chain.

ReleaseRelease verificationUsers and systems can inspect who signed the software.

TimeTimestamp evidenceA timestamp can record when a valid signature was created.

Important distinction: the certificate authenticates the signer. It does not certify that the software itself is safe.

What HARICA IV Does Not Guarantee

Individual validation is not a software security audit.

An IV Code Signing certificate does not guarantee malware free software, absence of vulnerabilities or bugs, Microsoft approval, SmartScreen acceptance, high application reputation, safe behavior by the publisher, or the absence of security warnings in every environment.

HARICA IV vs OV vs EV

Factor	IV	OV	EV
Publisher	Natural person	Legal entity	Legal entity
Individual developer	Yes	No as publisher identity	No
Company publisher	No	Yes	Yes
Validation	Individual	Organization	Extended organization
Company registry information	No	Organization information	Official registry information
Main purpose	Individual software publisher	Company software publisher	Enhanced organization validation
Hardware protected key	Required	Required	Required

HARICA IV vs Other Individual Code Signing Certificates

A code signing certificate comparison should be based on documented product characteristics rather than a generic provider ranking. Useful dimensions include the identity represented, validation process, private key requirements, hardware options, supported signing technologies, lifecycle, current price and platform compatibility.

Identity modelWho appears as the software publisher?

ValidationHow is the individual applicant verified?

Key protectionWhat hardware security baseline is required?

Hardware optionsCan the subscriber use an own compliant device?

Signing toolsWhich Windows and Java workflows are supported?

LifecycleHow are expiry, renewal and replacement handled?

HARICA IV Eligibility Requirements

HARICA's current individual Code Signing guide requires the applicant's personal information to match the government issued identification document exactly. The current workflow also includes identity documents, authorization or validation steps, transaction completion, HARICA validation and certificate acceptance.

Natural personApply as an individual publisher or qualifying sole proprietor path.

Accurate identity dataPersonal information must match the identity document.

Identity evidenceProvide the identification information requested during the process.

Subscriber informationComplete the certificate request using the required personal details.

Hardware keyPrepare the required secure hardware signing device.

ValidationWait for HARICA validators to approve the submitted information.

HARICA's current guide is the source of truth for the documents and validation methods required at the time of application. Additional verification information should not be assumed from another certificate type.

How HARICA Validates an Individual Applicant

ApplicationCreate or access the HARICA CertManager account.

Applicant informationEnter personal information that matches identity evidence.

Identity validationSubmit the required identity and validation information.

Key generationPrepare the protected hardware key environment.

HARICA validationValidators check the submitted information.

Certificate acceptanceAccept the certificate after validation is completed.

ImportImport the certificate into the signing token.

SignUse the protected key to sign release artifacts.

Private Key Protection

HARICA states that from June 1, 2023, it exclusively issues Code Signing certificates to hardware devices. Subscribers who use their own device must meet the required security standard. The current stated baseline is FIPS 140 2 Level 2 or Common Criteria EAL 4+.

What the hardware protects

Private key generation
Private key storage
Key use during signing
PIN protected access
Controlled signing operations

Why the key matters

The public certificate can be distributed and inspected. The private key is the credential that creates signatures. If it can be copied or exposed, an attacker may be able to create signatures associated with the publisher identity.

Do not treat the signing token as ordinary removable storage or copy private signing material into a build repository.

HARICA IV Hardware Token

HARICA's current individual request guide describes a hardware signing workflow in which the cryptographic device can be prepared and sent to the subscriber's physical address. After issuance, the certificate can be downloaded in DER format and imported into the token management software.

Token deliveryReceive the cryptographic device through the HARICA process.

Token setupInitialize the device and protect access with its PIN.

Certificate issuanceComplete validation and accept the issued certificate.

Certificate importImport the issued certificate into the token management software.

HARICA CertManager
      ↓
Identity validation
      ↓
Certificate issuance
      ↓
Download DER certificate
      ↓
Token management software
      ↓
Import certificate
      ↓
Protected signing key
      ↓
Sign release

Can You Use Your Own HSM or Token?

HARICA states that subscribers may use their own hardware device when it meets the required security standard. That allows an individual publisher with an established signing environment to use a compliant hardware token or HSM rather than treating the HARICA supplied device as the only possible architecture.

FIPS 140 2 Level 2Minimum security baseline stated by HARICA.

Common Criteria EAL 4+Alternative minimum security baseline stated by HARICA.

Hardware tokenSuitable for an individual workstation signing setup when compliant.

HSMCan fit a controlled signing environment when compliant.

Key generationKeep generation and private key operations inside protected hardware.

ProvisioningCertificate provisioning must follow HARICA's issuance process.

HARICA IV Code Signing on Windows

HARICA lists Windows executable files, installation files, libraries and other Portable Executables among its Code Signing targets. The signing process can use Microsoft Authenticode compatible tooling, while the protected private key remains in the hardware device.

PEEXESign Windows executable releases.

InstallerMSISign Windows installation packages.

LibraryDLLSign supported Windows libraries.

PortableCABHARICA lists CAB among supported Portable Executables.

ComponentOCXSign applicable ActiveX component files.

OtherXPI / XAPHARICA lists these additional signing targets.

Build Windows artifact
      ↓
Select HARICA IV certificate
      ↓
Access protected hardware key
      ↓
Create Authenticode signature
      ↓
Apply timestamp
      ↓
Verify certificate chain
      ↓
Release signed artifact

HARICA IV and Microsoft SmartScreen

HARICA's current Code Signing page states that EV is required for software to gain instant reputation on Microsoft Windows platforms. That means IV should not be presented as providing the EV specific reputation treatment described by HARICA.

What IV provides

Validated individual publisher identity
Cryptographic software signature
Software integrity verification
Certificate chain for trust evaluation

What IV does not provide

HARICA's stated EV instant reputation treatment
Guaranteed absence of SmartScreen warnings
Automatic Microsoft application approval
Equivalent treatment to EV

Practical distinction: signing identity and Windows reputation are related but not interchangeable. HARICA explicitly identifies EV for the instant reputation scenario described on its current Code Signing page.

HARICA IV and Windows Drivers

Software signing support and Microsoft's driver signing program requirements are separate questions. HARICA's current product page specifically says EV is required for participation in the Windows Hardware Compatibility program.

Can sign codeIV is a Code Signing certificate for an individual publisher.

Driver

Additional requirementsWindows driver distribution has program specific requirements beyond having a signing certificate.

Microsoft programHARICA identifies EV as required for its Windows Hardware Compatibility program scenario.

Check

Verify before purchaseConfirm the current Microsoft submission path and certificate requirement.

HARICA IV for Java Code Signing

HARICA explicitly lists Java Code among supported signing scenarios. For Java archives, the workflow commonly centers on the Java signing toolchain and certificate selection rather than Windows Authenticode.

JARPrepare the Java archive for release.

JarsignerSelect the certificate and access the protected key.

TimestampAdd trusted signing time as part of the release workflow.

VerifyCheck the signature, certificate and chain before publication.

Supported File Types and Signing Scenarios

File / software type	HARICA Code Signing relevance
EXE	Supported
DLL	Supported
MSI	Supported
CAB	Supported
OCX	Supported
XPI	Supported
XAP	Supported
VBS / scripts	Listed by HARICA
Java JAR	Supported
Windows drivers	Special Microsoft requirements apply

How to Sign Software With HARICA IV

BuildCreate and freeze the release artifact that will be published.

Protect artifactKeep the exact release file under controlled release management.

Access hardware keyUse the compliant token or HSM without exporting the private key.

SignCreate the platform appropriate digital signature.

TimestampAdd trusted signing time to the release.

VerifyCheck signature, certificate, chain and timestamp.

ReleasePublish only the verified signed artifact.

Timestamping

Timestamping records evidence of when a valid signature was created. It is useful when a signed release needs to remain verifiable after the certificate's own validity period ends. It should not be described as a way to make a compromised or revoked certificate universally valid.

Without timestamp planning

The release may depend more heavily on the certificate's validity state when later verification occurs.

With a trusted timestamp

The release contains evidence of the signing time, allowing verification systems to distinguish the historical signing event from later certificate expiration.

Certificate Chain and Trust

End entityHARICA IV Code Signing certificate identifies the individual publisher.

Intermediate CAConnects the end entity certificate to the issuing hierarchy.

Root CAProvides the trust anchor recognized by the relying platform.

VerificationSoftware and operating systems evaluate the chain and signature.

HARICA's published CPS identifies policy information for Individual Validation and Code Signing. The actual chain presented by an issued certificate should be inspected from the certificate itself.

HARICA IV Code Signing Certificate Validity

Validity should be checked against HARICA's current product and issuance documentation immediately before publishing or purchasing. HARICA's published policies have changed over time, so older two year Code Signing values should not automatically be carried into a 2026 product page.

Certificate validityConfirm the current validity selected in HARICA CertManager for the IV product.

ReissueDetermine whether a new certificate must be issued during a longer product or service term.

RenewalPlan the next certificate before the active certificate reaches its end date.

TimestampingInclude timestamping in the release process rather than treating it as a later repair.

Current page rule: no unsupported exact validity number is stated here because the supplied source explicitly says the value should be researched immediately before publishing.

HARICA IV Code Signing Cost

HARICA Code Signing

From €59 HARICA listed starting price

HARICA's current Code Signing page lists a starting price of €59 per year across its Code Signing offering. The exact IV price, duration and hardware cost should be confirmed in CertManager before purchase.

View HARICA Code Signing

Certificate priceConfirm the current IV selection and duration in HARICA CertManager.

HardwareAccount for the required token or a compliant customer owned device.

OperationsConsider token replacement, renewal, reissue and controlled signing infrastructure.

HARICA's historical hardware policy announcement said the certificate and hardware device cost remained unchanged when hardware protection became mandatory in 2023. That historical statement is not treated as a current IV price.

HARICA IV for CI/CD

Hardware protected signing changes the release architecture. The private key should not be copied into the build server or stored as a normal pipeline secret. Instead, separate artifact creation from controlled production signing.

Build

Build serverCompile and package without exposing the private signing key.

Gate

Release approvalVerify the artifact before it reaches the signing environment.

Sign

Protected deviceUse the hardware token or compliant HSM for signing.

Publish

Release artifactVerify signature and timestamp before distribution.

Key isolationKeep the private key inside protected hardware.

Access controlRestrict production signing access.

Artifact verificationConfirm exactly what is being signed.

Signing authorizationRequire release controls before signing.

Audit logsRecord signing activity and release identifiers.

Hardware availabilityPlan how the token or HSM is accessed by the signing workflow.

What Happens If the HARICA IV Private Key Is Lost?

A lost token and a compromised private key are different incidents. A lost device can prevent access to the signing key. A compromised key creates a signing security incident because another party may be able to create signatures.

Lost device

Stop accessSecure the account and determine whether the device is recoverable.

Compromise

Contact HARICAReport the incident and follow HARICA's revocation process where required.

Investigation

Review releasesDetermine which signed artifacts may have been affected.

Replacement

New signing setupSecure a replacement key and update the signing infrastructure.

Certificate Renewal and Replacement

Expiration

The active certificate reaches its validity end date.

Renewal

A new certificate or service period is obtained for continued signing.

Reissue

A new certificate is issued within an existing applicable product or service arrangement.

Replacement

A new credential may be required after compromise, device loss or another lifecycle event.

Keep renewal, reissue and replacement as separate operational events in the certificate lifecycle documentation.

Plan renewal early enough to validate identity, prepare compliant key storage and avoid interrupting software releases; the code signing certificate renewal process covers the main timing and preparation considerations.

HARICA IV vs HARICA OV

Question	IV	OV
Who is identified?	Natural person	Legal entity
Individual developer	Yes	No
Company publisher	No	Yes
Organization identity	No	Yes
Main use	Individual software publisher	Company software publisher

HARICA IV vs HARICA EV

Question	IV	EV
Individual publisher	Yes	No
Legal entity	No	Yes
Extended validation	No	Yes
Windows instant reputation	Not the EV treatment described by HARICA	HARICA says EV is required
Windows Hardware Compatibility Program	Not the target	HARICA says EV is required
Main audience	Individual publisher	Organization

These distinctions follow HARICA's current Code Signing product description. They should not be generalized into claims about every CA's IV, OV or EV product.

Common HARICA IV Code Signing Problems

Token not detectedCheck token connection, device drivers and token management software.

Token driver problemVerify the supported device software installation.

Certificate not visibleConfirm that the certificate has been imported into the token environment.

Incorrect PINFollow the token's credential recovery and lockout procedures.

Certificate installation issueVerify certificate format and import steps.

SignTool cannot locate certificateCheck the certificate store and hardware provider path.

Signature verification failureInspect the artifact, certificate, chain and signature.

Certificate chain errorCheck intermediate and root trust paths.

Timestamp errorCheck timestamp configuration and network access.

SmartScreen warningRemember that IV is not the EV reputation treatment described by HARICA.

Java JAR signing failureCheck Jarsigner configuration and certificate selection.

Hardware device problemVerify token status, device software and physical connection.

When HARICA IV Is the Appropriate Certificate

Individual publisher scenarios

You publish software as an individual.
Your publisher identity should be your personal identity.
You do not need a company identity in the certificate.
You need standard code signing.
You can meet HARICA's hardware key requirements.

When to examine OV or EV

Software is published by a legal entity.
The company identity needs to appear as publisher.
You require the EV specific Windows treatment described by HARICA.
You need Windows Hardware Compatibility Program participation.

Individual Code Signing Checklist

Confirm individual publisherMake sure the software is being published under your individual identity.

Verify identity dataMatch personal information to the identity document.

Identify platformsDetermine which Windows or Java artifacts need signing.

Choose hardwareUse the HARICA device or a compliant own device.

Confirm security standardCheck FIPS 140 2 Level 2 or Common Criteria EAL 4+ compliance.

Plan PIN managementDocument secure device access and recovery procedures.

Plan timestampingInclude timestamping in the signing workflow.

Plan lifecycleTrack validity, renewal, reissue and replacement events.

Secure CI/CDKeep the private key outside ordinary build infrastructure.

Test verificationVerify signatures before releasing software.

Document signingRecord which certificate and device sign each release.

Check Microsoft requirementsEspecially important for SmartScreen and driver scenarios.

HARICA IV Code Signing FAQ

What is HARICA IV Code Signing Certificate?

It is HARICA's Individual Validated Code Signing certificate for software publishers who are represented as natural persons.

What does IV mean in HARICA Code Signing?

IV means Individual Validated. HARICA uses it for a Code Signing certificate that identifies a natural person as the software publisher.

Who can get a HARICA IV Code Signing Certificate?

It is intended for individual software publishers and the individual or sole proprietorship request path documented by HARICA.

Can an individual developer get HARICA IV?

Yes. HARICA provides a dedicated current request process for individuals or sole proprietorships under IV.

Can a company get a HARICA IV certificate?

IV is the individual publisher model. A legal entity publisher should examine HARICA OV or EV instead. Organizations that require Extended Validation should evaluate the HARICA EV Code Signing certificate and confirm the applicable eligibility requirements.

What identity appears on a HARICA IV certificate?

The certificate is designed to identify the natural person who is the software publisher.

How does HARICA verify an individual applicant?

HARICA's current guide requires accurate personal information matching government issued identity evidence, followed by validation by HARICA's validators.

What documents are required for HARICA IV?

The exact documents and validation method should be taken from HARICA's current CertManager request flow. The current guide requires identity information and evidence and does not support inventing a fixed document list from another certificate type.

Does HARICA IV require a hardware token?

HARICA states that Code Signing certificates have been issued to hardware devices since June 1, 2023.

Can I use my own HSM for HARICA IV?

Yes, if the device meets HARICA's required security baseline.

What security standard must the signing device meet?

HARICA states a minimum of FIPS 140 2 Level 2 or Common Criteria EAL 4+ for a subscriber supplied device.

Can HARICA IV sign EXE files?

Yes. HARICA lists individual executable files such as EXE among its supported Code Signing targets.

Can HARICA IV sign DLL files?

Yes. HARICA lists DLL among supported signing targets.

Can HARICA IV sign MSI files?

Yes. HARICA lists MSI installation files among supported signing targets.

Can HARICA IV sign Java JAR files?

Yes. HARICA lists Java Code among its supported signing scenarios.

Can HARICA IV be used for Windows drivers?

HARICA lists Windows drivers as a Code Signing target, but its current product page separately states that EV is required for participation in the Windows Hardware Compatibility program.

Does HARICA IV provide instant SmartScreen reputation?

HARICA's current Code Signing page says EV is required for software to gain instant reputation on Microsoft Windows platforms. IV should therefore not be presented as providing that EV specific treatment.

Is EV required for the Windows Hardware Compatibility Program?

HARICA's current Code Signing page states that an EV Code Signing certificate is required for participation in the Windows Hardware Compatibility program.

How much does HARICA IV Code Signing cost?

HARICA's current Code Signing page lists a starting price of €59 per year for its Code Signing offering. The exact IV price and selected duration should be confirmed in CertManager.

How long is a HARICA IV certificate valid?

The exact current IV validity should be confirmed in HARICA CertManager or current issuance documentation. Older HARICA policy documents show different historical Code Signing limits, so an old fixed number should not be assumed for the current product.

What happens if the signing token is lost?

Loss of the token is primarily an access and device management incident. Secure the account and follow HARICA's support and replacement procedures. A suspected private key compromise requires a different response.

What happens if the HARICA IV private key is compromised?

Stop signing, contact HARICA, follow the applicable revocation process, investigate affected releases, secure a replacement key and update the signing workflow.

Can HARICA IV be used in CI/CD?

Yes, but the private key should remain in protected hardware. A dedicated signing machine, HSM or controlled signing service can separate production signing from ordinary build activity.

What is the difference between HARICA IV and OV?

IV identifies a natural person as publisher, while OV identifies a legal entity as publisher.

What is the difference between HARICA IV and EV?

IV is for an individual publisher. EV is for a legal entity and adds Extended Validation. HARICA also identifies EV as required for the instant Windows reputation and Windows Hardware Compatibility Program scenarios described on its current Code Signing page.

Evaluate HARICA IV Around Your Individual Signing Workflow

The practical questions are straightforward: are you publishing as an individual, can you complete HARICA's identity validation, can you use the required protected signing hardware, which Windows or Java artifacts need signing, and do your Microsoft specific requirements call for EV instead?

View IV Request Guide