What is a Code Signing Certificate?

A code signing certificate is a digital certificate that allows software developers and publishers to digitally sign their applications, scripts, and executables. The signature proves two things: the identity of the publisher, and that the code has not been altered since it was signed.

When you download a signed application on Windows, macOS, or Linux, your operating system verifies the signature against the Certificate Authority's root. If the signature is valid, the OS displays the publisher's name. If it's missing or invalid, users see a security warning — often enough to stop them from installing.

How Code Signing Works

1. The developer applies for a code signing certificate from a trusted CA (DigiCert, Sectigo, GlobalSign…)
2. The CA verifies the developer's identity (organization or individual)
3. The developer uses a private key to sign the executable or script
4. The signature and certificate are embedded in the file
5. When a user runs the file, the OS checks the signature against the CA's root

Code Signing vs SSL Certificates

Both types use public key infrastructure (PKI), but they serve different purposes:

	SSL/TLS Certificate	Code Signing Certificate
Protects	Network connections (HTTPS)	Software files and scripts
Used by	Web servers	Software developers
Verifies	Domain ownership	Publisher identity
Visible to users as	Padlock in browser	"Publisher: Company Name" in OS dialog
Expiry effect	Browser security warning	Signature still valid if timestamped

OV vs EV Code Signing Certificates

There are two main validation levels for code signing certificates:

• Organization Validated (OV): The CA verifies that the organization exists. Standard level, used by most developers. The publisher name appears in the OS security dialog.
• Extended Validation (EV): Stricter identity verification. On Windows, EV certificates immediately establish a reputation with Microsoft SmartScreen — meaning users see no "Unknown Publisher" warning from day one. Required for kernel-mode drivers on Windows.

What Files Can Be Signed?

• Windows executables and installers (.exe, .msi, .dll)
• macOS applications and packages (.app, .pkg, .dmg)
• PowerShell and other scripts (.ps1, .vbs)
• Java archives (.jar)
• Android apps (.apk)
• Office macros and add-ins

The Importance of Timestamping

When you sign code, always use a trusted timestamp server. Timestamping embeds the time of signing into the signature, cryptographically proved by the CA's timestamp authority. This means that even after your code signing certificate expires, signatures created before expiry remain valid — protecting older software releases you no longer maintain.

Without timestamping, any signature becomes invalid as soon as the certificate expires.

Where to Get a Code Signing Certificate

• DigiCert — industry leader, fast issuance, widely trusted
• Sectigo (Comodo) — affordable OV certificates, good for indie developers
• GlobalSign — strong enterprise support
• Certum — budget-friendly option, popular in Europe

Note: Code signing certificates cannot be obtained for free (unlike SSL certificates via Let's Encrypt) because they require verified identity — a process that involves human review.