IdenTrust EV Code Signing Certificate
A detailed guide to TrustID EV Code Signing, including organization validation, private key protection, supported signing environments, timestamping, pricing, issuance, and certificate lifecycle.
- Validation: Extended Validation
- Key storage: Hardware token or compliant HSM
- Timestamping: RFC 3161
- Use: Software, drivers, firmware and other code
What Is IdenTrust EV Code Signing?
TrustID EV Code Signing connects a validated publisher identity with signed software. The EV model adds enhanced organization validation to the signing process while keeping the signing key under the subscriber's control.
What EV adds
IdenTrust performs additional identification and authentication checks around the organization, its jurisdiction, business existence, authorized representatives and certificate request roles.
What it does not prove
Identity assurance is not software security assurance. IdenTrust's subscriber terms state that the certificate does not establish that software is malware free, vulnerability free, or inherently safe.
Who Is IdenTrust EV Code Signing For?
The product is structured for organizations that publish code and need enhanced identity assurance with protected signing keys.
Software publishers
Organizations distributing applications to customers or other users.
Firmware and driver teams
Teams signing firmware, drivers and other platform specific code.
Enterprise signing operations
Organizations that need controlled private key storage and may use an HSM based signing environment.
What Does EV Validation Actually Verify?
EV validation goes beyond simply placing an organization name on a certificate. IdenTrust's current EV documentation describes identification and authentication checks and may use public or private databases or other sources.
Organization identity
Legal organization identity, organization information, jurisdiction and business existence.
People and authority
Authorized representatives, contract signer and certificate requestors are part of the EV authorization model.
Additional checks
Identity and authentication checks can involve external information sources used during validation.
What Information Appears in the Certificate?
The certificate represents the validated organization identity used for the signing relationship. IdenTrust EV documentation identifies fields such as:
Legal name
The organization's legal name as represented in the certificate identity information.
Business category
The organization business category associated with the validated identity.
Jurisdiction
The organization jurisdiction of incorporation.
EV Code Signing vs Standard IdenTrust Code Signing
Both products support software signing and protected key storage. The key distinction in the supplied IdenTrust portfolio is the enhanced validation associated with EV.
| Area | TrustID Code Signing | TrustID EV Code Signing |
|---|---|---|
| Organization identity | Verified | Verified with enhanced validation |
| Publisher assurance | Standard | Higher identity assurance |
| Private key protection | Hardware/HSM | Hardware/HSM |
| Timestamping | Available | Available |
| Software signing | Yes | Yes |
| Firmware/driver signing | Yes | Yes |
| Price | $225/year | $281/year |
What EV Does Not Automatically Give You?
EV should not be treated as a guarantee about software behavior, security or every platform's user experience.
EV does not automatically mean
- The software is malware free.
- The software has no vulnerabilities.
- Windows will always show a particular warning state.
- Users will automatically trust unknown software.
It also does not establish
- Compliance with every security requirement.
- That the publisher is trustworthy in every business context.
Supported Software and Signing Formats
IdenTrust TrustID material covers multiple signing environments and code types.
Microsoft Authenticode
EXE, DLL, MSI, CAB and OCX signing are among the documented Windows related formats.
Other software ecosystems
IdenTrust material lists Java, Apple software, Adobe AIR, Microsoft Office macros/VBA and browser add-ons.
Platform code
Firmware and drivers are identified as supported EV Code Signing use cases, subject to their platform specific requirements.
Private Key Protection
The private key is the critical asset in a code signing operation. The supplied IdenTrust EV agreement states that the subscriber generates the key pair and that IdenTrust does not have access to the subscriber's private key.
Hardware token
The signing key can be kept in protected hardware for a controlled signing workstation or smaller signing operation.
HSM
HSM storage is suited to enterprise signing infrastructure and controlled automated workflows.
Protection requirements
The outline identifies FIPS 140-2 Level 2 and a Common Criteria EAL4+ option where applicable to protected storage.
| Option | Best suited for | Operational considerations |
|---|---|---|
| Hardware token | Individual signing workstation or smaller signing operation | Portable physical device with direct signing access and controlled custody. |
| HSM | Enterprise signing infrastructure and controlled automated workflows | Centralized key control, integration with signing infrastructure and automation considerations. |
How IdenTrust EV Code Signing Is Issued
The supplied workflow separates organization preparation and authorization from key generation, validation and certificate retrieval.
Organization and Authorization Requirements
EV enrollment requires more than a certificate request form. The authorization model identifies who represents the organization and who is permitted to request certificates.
Authorized representative
Represents the organization during the validation and authorization process.
Contract signer
Has a defined role in accepting the contractual relationship for the certificate request.
Certificate requestor
Is the person permitted to submit or manage the certificate request within the authorization framework.
IdenTrust EV Code Signing Pricing
The supplied current IdenTrust portfolio lists EV Code Signing at $281 for one year.
$281 / 1 year
Current listed EV Code Signing price in the supplied research.
Hardware or HSM storage
The current portfolio lists both hardware storage and HSM storage options at $281 per year. Additional hardware costs can apply depending on the approved device and purchase configuration.
Confirm current EV pricing and enrollment requirements
Check the current IdenTrust product details before purchase, especially the approved key storage configuration and any additional hardware charges.
View IdenTrust Product DetailsTimestamping With IdenTrust
IdenTrust currently provides a free RFC 3161 compliant timestamping service for TrustID Code Signing and EV Code Signing.
RFC 3161
The timestamp records signing time through a trusted timestamp authority rather than relying only on the certificate's validity window.
Expiration context
Timestamping matters when a certificate later expires because the signature can retain evidence of when the signing operation occurred.
Long term validation
Timestamped signatures can support continued validation of previously signed software subject to the applicable trust and revocation conditions.
Signing Windows Software With IdenTrust EV
Windows signing uses the Authenticode ecosystem. A production workflow should include signing, timestamping and post signing verification.
EXE, DLL, MSI, CAB or OCX
Use SignTool and the protected signing key
Apply RFC 3161 timestamping
Check signature and certificate chain
Driver and Firmware Signing
IdenTrust's EV material identifies firmware and driver signing as supported use cases. That does not mean an EV certificate alone satisfies every platform's driver or firmware requirements.
Driver signing
Check the target operating system and its current driver signing requirements before release.
Firmware signing
Confirm the device platform, boot chain and vendor requirements that apply to the firmware release process.
Platform rules
EV certificate ownership is one part of the signing process and should not be treated as a substitute for platform specific approval or submission requirements.
Using IdenTrust EV in CI/CD
Protected key storage changes how signing should be designed in an automated delivery pipeline. The private key should remain in the controlled signing environment rather than being exported and copied between build servers.
Traditional workflow
Developer/build server → protected signing environment → signed artifact
Signing occurs in an environment with controlled access to the protected key.
Enterprise workflow
Build pipeline → controlled signing service/HSM → signature → timestamp → release
The signing function is separated from the general build infrastructure.
Certificate Chain and Trust
A signed artifact is validated through the certificate chain and the trust store used by the verification environment.
Your EV Code Signing certificate
IdenTrust EV Code Signing subordinate CA
Trusted root in the validation environment
Chain building and signature validation
What Happens When the Private Key Is Lost or Compromised?
The supplied IdenTrust subscriber documentation requires the subscriber to stop using the certificate when the corresponding private key is lost, disclosed, compromised or suspected of unauthorized use.
EV Certificate Expiration and Renewal
Plan renewal around certificate expiration rather than treating renewal as permission to continue making new signatures with an expired certificate.
Expiration
New signing operations should use a currently valid certificate and protected private key.
Timestamped signatures
Previously signed software can retain evidence of signing time when appropriate timestamping was applied.
Renewal and replacement
Prepare the next certificate, verify the new chain and test production signing before the current certificate expires.
IdenTrust EV vs DigiCert EV vs Sectigo EV vs SSL.com EV
Compare providers on the implementation details that affect your signing environment rather than using a best provider ranking.
| Area | What to compare |
|---|---|
| Validation model | Organization checks, authorization roles and validation evidence. |
| Key storage | Hardware token options and protected signing requirements. |
| HSM support | Whether the selected provider and configuration support your HSM based architecture. |
| Timestamping | RFC 3161 availability and operational integration. |
| Windows and Java | Supported signing environments and documented tooling. |
| CI/CD | Available signing architecture and key management options. |
| Pricing | Certificate price plus hardware, HSM and operational costs. |
| Lifecycle | Renewal, replacement, revocation and compromise procedures. |
Who Should Choose IdenTrust EV?
Use the following scenarios to determine whether the product requirements match your signing environment.
Potentially relevant when
- Organization identity assurance is important.
- Software is publicly distributed.
- Hardware backed key storage is required.
- Firmware or driver signing is involved.
- RFC 3161 timestamping is needed.
- Your organization already uses IdenTrust infrastructure.
Consider another product when
- Individual identity is the actual requirement.
- Standard organizational validation is sufficient.
- Your platform requires a specific CA or workflow.
- Your signing environment needs capabilities not offered by the selected IdenTrust configuration.
IdenTrust EV Code Signing Buying Checklist
Use this checklist before purchasing or starting the validation process.
- Confirm legal organization details.
- Identify the authorized signer.
- Determine certificate requestors.
- Choose hardware token or HSM.
- Prepare validation documents.
- Decide signing platforms.
- Plan timestamping.
- Decide CI/CD architecture.
- Protect signing credentials.
- Document the revocation procedure.
- Verify the certificate chain after issuance.
- Test signing before production release.
Frequently Asked Questions
Answers based on the supplied IdenTrust EV Code Signing research and current product notes.
What is an IdenTrust EV Code Signing Certificate?
How much does IdenTrust EV Code Signing cost?
What does IdenTrust verify for EV Code Signing?
Who can obtain an IdenTrust EV Code Signing Certificate?
Does IdenTrust EV Code Signing require a hardware token?
Can I use my own HSM?
Does IdenTrust EV Code Signing support Authenticode?
Can I use it to sign Java applications?
Can IdenTrust EV Code Signing be used for drivers?
Does IdenTrust provide timestamping?
What happens if the private key is compromised?
Does EV Code Signing guarantee that software is safe?
What is the difference between IdenTrust Code Signing and EV Code Signing?
How long is an IdenTrust EV Code Signing Certificate valid?
Can I use IdenTrust EV Code Signing in CI/CD?
Related IdenTrust Resources
Explore the related technical and buying resources for code signing, private key protection, timestamping and software verification.
Evaluate the certificate against your signing environment
Confirm validation roles, protected key storage, signing platforms, timestamping, lifecycle procedures and current purchase terms before production deployment.