IdenTrust OV Code Signing Certificate
IdenTrust's TrustID Code Signing certificate verifies the identity and organizational affiliation of a software publisher before allowing digitally signed software to be associated with that organization.
- Official product: TrustID Code Signing
- Identity model: Organization Identity
- Key storage: Hardware token or HSM
- Timestamping: RFC 3161
Is IdenTrust OV Code Signing the Same as TrustID Code Signing?
“OV Code Signing” is common industry and search terminology. IdenTrust's current public product name is TrustID Code Signing, described as Code Signing | Organization Identity. This page uses the OV term for search intent while keeping IdenTrust's current product terminology clear.
Search terminology
Users commonly use “IdenTrust OV Code Signing Certificate” when looking for organization validated code signing.
Official terminology
IdenTrust currently presents the product as TrustID Code Signing and distinguishes it from TrustID EV Code Signing.
What Does IdenTrust Code Signing Verify?
The identity layer is the core of the product. IdenTrust states that the certificate validates the affiliation between the certificate holder and business organization.
Organization identity
Information used to identify the business organization associated with the certificate.
Applicant and authorization
The applicant and authorization to obtain the certificate form part of the validation process.
Organizational affiliation
The certificate connects the holder with the identified business organization.
What Does the Certificate Establish?
When a signed artifact is properly validated, the certificate provides an identity chain between the publisher, the digital signature and the identified organization.
Who is associated with the signing certificate
Cryptographic evidence attached to the artifact
Identifies the publisher and organization
Validated business affiliation
Who Should Use IdenTrust Code Signing?
IdenTrust describes TrustID Code Signing for software developers and organizations that make and distribute applications and executable code.
Software publishers
Software companies and independent software vendors distributing applications.
Windows publishers
Organizations distributing executable Windows applications and installers.
Hardware and platform teams
Firmware and driver publishers that need an organization identity certificate and protected signing key.
IdenTrust Code Signing vs EV Code Signing
The current IdenTrust portfolio separates standard organization identity Code Signing from EV Code Signing.
| Area | TrustID Code Signing | TrustID EV Code Signing |
|---|---|---|
| Organization identity | Verified | Verified |
| Business affiliation | Validated | Validated |
| Validation level | Standard organization identity | Enhanced business operations validation |
| Private key protection | Hardware / HSM | Hardware / HSM |
| Timestamping | RFC 3161 | RFC 3161 |
| Starting price | $225/year | $281/year |
| Main distinction | Organization identity | Higher identity assurance |
What Is Included With IdenTrust Code Signing?
The product combines organization identity validation with a certificate and protected signing infrastructure.
Organization identity
Identity and organizational affiliation are represented through the certificate.
Protected key storage
The current IdenTrust store describes compliant hardware storage and HSM storage options.
Timestamping and trust
RFC 3161 timestamping, certificate chain and signing compatibility form part of the operational setup.
Hardware Token vs HSM Storage
Choose the storage model around the scale and control requirements of the signing operation.
| Area | Hardware Token | HSM |
|---|---|---|
| Key location | Dedicated hardware token | HSM |
| Portability | Higher | Lower |
| Centralized signing | Limited | Strong |
| CI/CD integration | More involved | Better suited |
| Enterprise deployment | Possible | More suitable |
| Key export | Restricted | Controlled by HSM architecture |
Private Key Protection
The private key is the signing authority. The certificate can be public, but unauthorized access to the private key can allow unauthorized signing.
Generate and protect
Generate the key within the intended protected environment and keep signing operations under controlled access.
Hardware backed signing
Token based and HSM based signing keep the private key within dedicated cryptographic infrastructure.
Key custody
Plan access control, backup considerations, token custody and compromise response before production use.
IdenTrust Code Signing Validation Process
The practical sequence can vary with the organization and application details. IdenTrust's current product information does not justify an invented issuance SLA.
What Information Is Associated With the Certificate?
After issuance, inspect the certificate subject and usage fields rather than relying only on the product name.
Identity fields
Common Name, Organization and organizational affiliation, plus country or locality where applicable.
Trust fields
Certificate issuer, validity dates and the chain used for trust validation.
Usage fields
Key Usage and Extended Key Usage identify the intended cryptographic purpose.
Supported Software and File Types
IdenTrust's current store lists multiple signing environments and formats.
Windows formats
EXE, DLL, MSI, CAB and OCX through the Microsoft Authenticode ecosystem.
Other environments
Java, Adobe AIR, Apple related signing scenarios, Mozilla object files and Microsoft Silverlight where applicable.
Platform code
Firmware and drivers are identified as use cases, subject to their own platform requirements.
Signing Windows Software With IdenTrust
A production Windows signing workflow should connect the protected certificate, SignTool, timestamping and post signing verification.
EXE, DLL, MSI or other artifact
Token or HSM signing access
Authenticode signing with SHA-256 digest
RFC 3161 timestamp, chain and signature check
Firmware and Driver Signing
Organization validation is only one part of driver and firmware release. Platform specific signing, submission and approval requirements still apply.
Drivers
Check the target operating system and its current driver signing program requirements.
Firmware
Confirm the hardware vendor, boot chain and platform requirements for firmware releases.
Certificate vs platform approval
Owning an organization validated certificate does not automatically satisfy every Microsoft driver signing or submission program.
IdenTrust Code Signing Timestamping
IdenTrust states that its Code Signing certificate includes a free RFC 3161 compliant timestamping service intended to support long term validation.
RFC 3161
A standard timestamp protocol that records the signing time through a timestamp authority.
Expiration context
Timestamping separates evidence of signing time from the later expiration of the certificate used to sign.
Long term validation
Previously signed software can retain timestamp evidence subject to trust and revocation conditions.
Certificate Chain and Trust
Signature verification depends on the end entity certificate, intermediate CA, trusted root and successful chain building.
Artifact with digital signature
IdenTrust Code Signing certificate
IdenTrust Code Signing intermediate
Root trust and path validation
Current IdenTrust Code Signing Validity
IdenTrust announced that effective February 26, 2026, newly issued Code Signing certificates have a maximum validity of 365 days to align with CA/Browser Forum requirements.
365 day maximum
Newly issued Code Signing certificates are subject to the announced 365 day maximum.
More frequent renewal
Release teams need a renewal process that can handle a shorter certificate lifecycle.
Validity vs timestamp
Certificate expiration and timestamped signature evidence are related but distinct concepts.
IdenTrust Code Signing Certificate Cost
The current price information distinguishes the certificate from optional or required storage hardware.
$225 / 1 year
Certificate with existing approved SafeNet token.
$325
Certificate plus SafeNet token according to the February 2026 order form.
$225
HSM option listed in the current order documentation.
Check the current IdenTrust product terms
Confirm the current order configuration, certificate price, hardware requirements and validity before purchasing.
What Happens When the Certificate Expires?
Plan certificate renewal before the current certificate reaches its end date.
What If the Private Key Is Compromised?
Key compromise should trigger a controlled incident response rather than continued signing from the affected environment.
Using IdenTrust Code Signing in CI/CD
Keep the signing authority separate from ordinary build infrastructure. The private key should not be exported into CI/CD variables.
Traditional
Developer workstation → Protected token → Signed artifact
Suitable where signing is controlled from a dedicated workstation and physical key custody is practical.
Enterprise
Build system → Signing environment/HSM → Signature → Timestamp → Release
Use controlled access, secrets management, auditability and separation between build and signing environments.
How to Verify an IdenTrust Signed File
Verification should check both the signature and the certificate identity and trust path, including command line signature verification when using SignTool.
Windows GUI
File → Properties → Digital Signatures → Signature Details → Certificate
Review publisher identity, signature validity, certificate chain, timestamp, expiration and revocation status.
Command line
Use SignTool verification to inspect the Authenticode signature and certificate chain.
Useful internal topics include How to Verify a Code Signature and command line verification.
IdenTrust Code Signing vs Other Organization Certificates
Use implementation details rather than a best provider ranking when comparing organization validated certificates.
| Provider | Product terminology | Organization identity | Hardware/HSM | Timestamping | Current listed starting price |
|---|---|---|---|---|---|
| IdenTrust | TrustID Code Signing | Yes | Yes | RFC 3161 | $225/year |
| DigiCert | Code Signing | Yes | Yes | Yes | Verify current |
| Sectigo | OV Code Signing | Yes | Yes | Yes | Verify current |
| SSL.com | OV Code Signing | Yes | Yes | Yes | Verify current |
| GlobalSign | Standard Code Signing | Yes | Yes | Yes | Verify current |
Compare certificate options before you buy
Review certificate types and provider options against your organization's validation and signing requirements.
When Should You Choose IdenTrust Code Signing?
Use these scenarios to match the certificate to your actual release and identity requirements.
It can fit when
- Your organization needs authenticated publisher identity.
- You distribute executable software.
- Hardware backed key storage is required.
- You need HSM based storage.
- You need RFC 3161 timestamping.
- Your organization already works with IdenTrust.
- You need standard organization identity rather than EV.
Consider EV instead when
- Your organizational requirements specifically call for EV.
- Your compliance or release policy requires enhanced business validation.
- Your platform or distribution workflow has an EV specific requirement.
IdenTrust Code Signing Buying Checklist
Confirm these points before purchasing or beginning validation.
- Confirm legal organization details.
- Confirm authorized applicant.
- Choose hardware or HSM.
- Check supported hardware.
- Determine signing platforms.
- Determine required file formats.
- Plan timestamping.
- Plan CI/CD integration.
- Establish key custody.
- Establish revocation procedure.
- Confirm current price.
- Confirm current validity.
- Test certificate chain after issuance.
Frequently Asked Questions
Questions focused on product terminology, validation, cost, technical use and lifecycle.
What is the IdenTrust TrustID Code Signing Certificate?
Is IdenTrust Code Signing an OV certificate?
How much does IdenTrust Code Signing cost?
Does IdenTrust verify the organization?
What is the difference between IdenTrust Code Signing and EV Code Signing?
Does IdenTrust Code Signing require a hardware token?
Can IdenTrust Code Signing use an HSM?
Does IdenTrust provide timestamping?
What file types can I sign with IdenTrust Code Signing?
Can IdenTrust Code Signing be used with SignTool?
Can it be used for Java signing?
Can it be used for firmware and driver signing?
Can I use IdenTrust Code Signing in CI/CD?
How long is an IdenTrust Code Signing Certificate valid in 2026?
What happens if my IdenTrust signing key is compromised?
What happens when an IdenTrust Code Signing Certificate expires?
How do I verify an IdenTrust signed application?
Related Resources
Related technical and buying resources cover organization validation, key protection, software signing, timestamping and verification.
Provider resources
IdenTrust Code Signing Certificates
IdenTrust EV Code Signing Certificate
Buying resources
Signing resources
Match the certificate to your signing workflow
Confirm organization validation, protected key storage, current pricing, certificate validity, signing platforms, timestamping and lifecycle procedures before production use.