Sectigo EV Code Signing Certificate
Establish a higher level of publisher verification for organizational software signing with Sectigo EV Code Signing. Choose a protected hardware signing setup that fits your workstation, HSM or automated release environment.
View Sectigo EV Certificate DetailsSectigo lists EV Code Signing at $829 per year and OV Code Signing at $715 per year on its current public pricing page.
What Is Sectigo EV Code Signing?
Sectigo EV Code Signing is an Extended Validation Code Signing certificate for organizations that need EV level validation for their software signing workflow. The certificate helps establish the identity of the software publisher and allows supported verification systems to determine whether signed content has been modified.
Higher validation for software publishers
EV differs from OV primarily in the validation level. Both certificate types support the core purpose of Code Signing: associating software with a validated publisher and helping verify software integrity.
EV is particularly relevant when a customer, platform, security policy or signing workflow specifically requires Extended Validation.
Designed for organizations
Sectigo's current Code Signing policy states that EV Code Signing certificates are not issued to individual applicants. The product should therefore be positioned toward organizations rather than individual developers applying in a personal capacity.
Key Features of Sectigo EV Code Signing
EV combines Extended Validation with protected private key handling and support for common software signing environments.
Extended Validation
EV requires more extensive validation than standard OV Code Signing and is intended for organizational applicants.
Hardware Protected Key
Current Code Signing requirements require suitable compliant hardware for generating, storing and using the private signing key.
Hardware Token
A physical cryptographic token can hold the private key for controlled workstation based signing.
HSM Support
Hardware Security Modules are suited to centralized signing infrastructure, automation and enterprise release environments.
Key Attestation
Attestation provides evidence that the private key was generated inside the approved hardware and cannot be exported.
CI/CD Workflows
Supported protected signing infrastructure can be integrated into automated build and release pipelines.
How Much Does Sectigo EV Code Signing Cost?
Sectigo's current public pricing page lists EV Code Signing at $829 per year and OV Code Signing at $715 per year.
| Product / pricing detail | Current official information |
|---|---|
| Sectigo OV Code Signing | $715/year |
| Sectigo EV Code Signing | $829/year |
| EV compared with OV | EV is $114/year more than OV at the displayed prices |
| Displayed annual price | OV: $715/year; EV: $829/year |
| Maximum individual certificate validity | 459 days |
Editorial note: Use the current displayed price of $829/year for EV and $715/year for OV. Recheck Sectigo’s page if pricing changes.
Compare Sectigo OV and EV Validation
Review the differences in applicant eligibility, validation level and purchase decisions before selecting a certificate.
Compare OV and EV CertificatesSectigo EV Code Signing Is for Organizations
EV is not simply a more expensive version of OV. The applicant requirements are different and should be made clear before purchase.
Who can use EV?
- Software companies distributing products under an organization.
- Independent software vendors with an organizational identity.
- Enterprise software teams.
- Organizations with EV specific security or procurement requirements.
- Organizations whose signing workflow requires EV validation.
Who should not be positioned as an EV buyer?
Sectigo's current policy states that EV Code Signing certificates are not issued to Individual Applicants. Do not present EV as a personal certificate for an individual developer.
Where an individual software publisher needs Code Signing, the page should direct them toward an applicable alternative rather than implying that EV is available to them.
Private Keys Must Stay Protected
Current Code Signing requirements make hardware based private key protection a central part of the issuance and signing workflow. The key should be generated, stored and used inside suitable compliant hardware rather than treated as an ordinary downloadable private key file.
Hardware token, HSM and supported remote provisioning workflows can serve different operational environments.
Sectigo EV Code Signing With a Hardware Token
Sectigo's EV Code Signing support documentation specifically covers SafeNet Authentication Client for Sectigo certificates supplied on an eToken. The client provides the software interface between the computer and the hardware token containing the certificate and private key.
Typical token based workflow
This approach is particularly suitable for controlled workstation based signing where the physical token can remain under the organization's control.
HSM Based EV Code Signing
An HSM becomes more relevant when signing needs to be integrated into centralized infrastructure rather than tied to a single workstation.
Where HSM fits
- Enterprise software teams
- Automated release environments
- CI/CD pipelines
- Centralized signing
- Multiple build environments
- Organizations with existing HSM infrastructure
Why the model matters
An HSM keeps the signing key inside protected hardware while allowing a properly configured signing process to request cryptographic operations. This is more suitable for organizations that need repeatable and controlled signing across release infrastructure.
What Is Key Attestation?
Key attestation is evidence generated by the HSM or token showing that the private key was created inside the hardware and remains non exportable. Sectigo uses this evidence during applicable issuance workflows to verify that the signing key is appropriately protected.
Generated inside hardware
The private key is created within the approved HSM or token rather than generated as an ordinary exportable file.
Remains protected
The key stays under the control of the hardware throughout the signing process.
Cannot be exported
Attestation provides evidence that the private key cannot be exported from the protected device.
Sectigo EV Code Signing Specifications
| Specification | Details |
|---|---|
| Certificate type | EV Code Signing |
| Validation | Extended Validation |
| Applicant type | Organization |
| Individual applicant | Not issued |
| EV price | $829/year |
| OV Code Signing price | $715/year |
| EV price relationship | $114/year higher than OV at displayed prices |
| Maximum certificate validity | 459 days |
| Private key | Hardware protected |
| Hardware token | Supported |
| HSM | Supported |
| Key attestation | Supported and required for applicable remote provisioning |
| Timestamping | Supported |
| CI/CD | Supported with appropriate infrastructure |
459 Days Maximum Certificate Validity
Sectigo began enforcing the new maximum Code Signing certificate validity on February 23, 2026. New EV Code Signing certificates can have a maximum validity of 459 days.
This applies to EV Code Signing as well as other current Code Signing certificates.
Multi Year Purchase Does Not Mean a Five Year Certificate
Sectigo continues to offer multi year Code Signing as a product term, but the product term should not be confused with the validity of an individual certificate.
Current multi year model
- Certificates must be reissued during the purchased term.
- Remote provisioning is required.
- The customer generates the key.
- The device must be supported.
- Key attestation is required.
Important provisioning change
The previous Sectigo provisioned token based multi year option was discontinued. Current page copy should therefore describe multi year purchasing as a product term with individual certificates subject to the 459 day maximum.
How Sectigo EV Validation Works
EV validation involves more verification than standard OV. The process is intended to establish the organization's legal identity, existence, authority of the person requesting the certificate and the relationship between the organization and the certificate request.
Legal organization
Confirm the legal identity of the organization applying for the certificate.
Organization existence
Verify that the organization meets the applicable existence requirements.
Request authority
Establish that the person requesting the certificate is authorized to do so.
Certificate relationship
Verify the organization's relationship with the certificate request.
Validation records
Applicable EV validation information must meet the relevant current requirements.
No fixed issuance promise
Do not promise a fixed issuance time because additional verification may be required.
What Can You Sign With Sectigo EV?
Sectigo's Code Signing materials position its certificates for multiple software and code signing environments. The exact implementation depends on the signing tool and protected key infrastructure.
Windows applications
Sign supported Windows executables and applications using Authenticode.
Installers
Sign software installers and packages to establish publisher identity and integrity.
Java
Use the certificate in supported Java signing workflows.
PowerShell
Sign supported PowerShell scripts.
Adobe AIR
Sectigo lists Adobe AIR among supported Code Signing environments.
Office and VBA
Sectigo's enterprise Code Signing documentation includes Office macro and VBA signing.
Apple workflow note: Sectigo lists Apple applications and plugins among supported environments, but this should not be presented as replacing Apple's own Developer ID or platform signing requirements.
Sectigo EV Code Signing for Windows Drivers
EV Code Signing can be relevant to Windows driver signing workflows where Microsoft requires the applicable EV certificate and signing process.
Keep the claim specific
Do not state that every Windows driver requires Sectigo EV. Instead, verify the current Microsoft requirements for the specific driver type and distribution method before selecting a certificate.
Sectigo EV Code Signing for CI/CD
A physical token is not always convenient for automated software releases. Organizations can use an HSM or supported remote provisioning approach so the private key remains protected while signing is integrated into the release pipeline.
Security rule: The signing key should never be copied into source repositories, build scripts or ordinary server storage.
Sectigo EV vs OV Code Signing
The fundamental difference is the validation level and the situations in which EV is required.
| Feature | Sectigo OV | Sectigo EV |
|---|---|---|
| Organization validation | Yes | Yes |
| Extended Validation | No | Yes |
| Individual applicant | Possible under applicable OV rules | No |
| Publisher identity | Yes | Yes |
| Hardware protected key | Yes | Yes |
| Token | Yes | Yes |
| HSM | Yes | Yes |
| Key attestation | Applicable current provisioning | Applicable current provisioning |
| Maximum certificate validity | 459 days | 459 days |
| General software signing | Yes | Yes |
| EV specific requirements | No | Yes |
| Current annual price | $715/year | $829/year |
Is EV Always Better Than OV?
No. EV is not automatically the right choice for every software publisher. The correct choice depends on what the actual signing workflow, platform requirement, security policy and procurement rules require.
Choose EV when
- Your organization specifically requires EV.
- Your workflow has an EV requirement.
- You have an applicable Windows driver signing requirement.
- Your security or procurement policy requires EV validation.
- The additional validation is relevant to your software distribution model.
OV may be sufficient when
You simply need organization validated Code Signing for supported software and there is no requirement for the higher EV validation level.
The decision should be based on the workflow requirement rather than choosing the certificate with the more expensive name.
Does Sectigo EV Guarantee SmartScreen Reputation?
Do not make this claim
A Code Signing certificate establishes publisher identity and software integrity, but it should not be presented as a guaranteed way to eliminate Microsoft SmartScreen warnings. SmartScreen reputation depends on more than the certificate's validation level.
Sectigo EV Code Signing vs Sectigo Certificate Manager
These products serve different purposes and should not be presented as alternatives to one another.
Sectigo EV Code Signing
The actual certificate used to sign software and establish the validated publisher identity.
Sectigo Certificate Manager
The broader platform for managing certificates and Code Signing workflows at organizational scale. Sectigo's enterprise documentation describes Code Signing capabilities within Certificate Manager, including workflows using key attestation.
Sectigo EV Code Signing FAQs
What is a Sectigo EV Code Signing Certificate?
It is an Extended Validation Code Signing certificate for organizations that need EV level validation for their software signing workflow.
How much does Sectigo EV Code Signing cost?
Sectigo displays OV Code Signing at $715/year and EV Code Signing at $829/year on its current public pricing page. Confirm the final checkout price and purchase terms before ordering.
Can an individual buy Sectigo EV Code Signing?
No. Sectigo's current Code Signing policy states that it does not issue EV Code Signing certificates to individual applicants.
Does Sectigo EV Code Signing require hardware protected keys?
Yes. Current Code Signing requirements require private keys to be generated, stored and used in suitable compliant hardware.
Can I use an HSM with Sectigo EV Code Signing?
Yes. Sectigo supports HSM based Code Signing workflows, including key attestation where applicable.
What is key attestation?
Key attestation is evidence generated by the HSM or token showing that the private key was generated inside the hardware and cannot be exported.
How long is a Sectigo EV Code Signing Certificate valid?
The current maximum validity is 459 days. Sectigo began enforcing this limit on February 23, 2026.
Can I purchase a multi year Sectigo EV Code Signing term?
Sectigo continues to offer multi year Code Signing as a product term, but certificates must be reissued during the term because each individual certificate is limited to 459 days. Multi year issuance uses remote provisioning with customer generated keys and key attestation.
Does Sectigo EV Code Signing automatically remove SmartScreen warnings?
No. EV should not be presented as a guaranteed SmartScreen bypass. Windows reputation systems use additional signals.
Is Sectigo EV better than Sectigo OV?
Not for every use case. EV provides a higher validation level and can be appropriate when a specific workflow or organizational policy requires it. OV may be sufficient for standard organization validated software signing.
Can Sectigo EV Code Signing be used for CI/CD?
Yes. Organizations can integrate protected signing into automated release pipelines using appropriate HSM or supported remote provisioning infrastructure.
Does EV replace Apple's own signing requirements?
No. Sectigo lists Apple applications and plugins among supported environments, but a Sectigo certificate should not be represented as replacing Apple's own Developer ID or platform signing requirements.
Check the Current Sectigo EV Offering
Review the current EV pricing, validation requirements, key protection options and signing workflow directly with Sectigo before purchasing.
Visit Official Sectigo Code Signing