The short answer is no for OV specifically, but yes for what you actually need. OV stands for Organization Validation, and the CA/B Forum’s definition of OV requires a verified legal organizational entity : a company, LLC, sole trader registration, or equivalent. A freelancer who operates under their personal name with no business registration cannot satisfy OV requirements, because there is no organization to validate.
The practical answer is that there are two legitimate paths to a publicly trusted code signing certificate for individual developers: Individual Validation (IV) certificates, which verify a person rather than a company, and minimal business registration in most jurisdictions which creates the legal entity needed for OV. This guide explains both, what they produce, and which is better for different situations.
Why OV Requires a Registered Entity
Organization Validation is defined by the CA/B Forum Code Signing Baseline Requirements as verification of a legal organizational entity’s existence, address, and phone number in qualified independent information sources. The CA checks government business registries, commercial databases like Dun and Bradstreet, and similar authoritative sources. A personal name does not appear in these sources in the way a registered business does.
The purpose of OV is to bind a cryptographic key to a verified organizational identity. When a user sees ‘Smith Development LLC’ in a UAC dialog, that name was verified against government records before it was placed in the certificate. An OV certificate for an individual’s personal name would misrepresent the validation level : the name hasn’t been verified through the organizational verification process, it’s been verified through a different process that’s actually called Individual Validation.
This is not a bureaucratic technicality. It reflects genuinely different trust signals. An OV certificate carries the implicit claim that a legal entity with verifiable business records signed this software. An IV certificate carries the implicit claim that a specific verified individual signed it. Both are legitimate and useful; they are different claims.
Path 1: Individual Validation (IV) Certificate
Individual Validation (IV) code signing certificates verify a person’s identity rather than an organizational identity. The certificate Subject field contains the individual’s verified full name. When a user runs software signed with an IV certificate, the UAC dialog shows ‘Verified publisher: Jane Smith’ rather than a company name.
SSL.com is currently the most accessible source of IV code signing certificates for individuals. Not all major CAs offer IV; it is a certificate type that fills a specific gap in the market for independent developers, researchers, and open-source contributors who want verified publisher identity without establishing a business entity.
What IV validation requires
- Government-issued photo ID: passport or national ID card. The name on the ID must exactly match the name you want on the certificate : including middle names or initials if they appear on your ID.
- Proof of current address: a recent utility bill, bank statement, or official correspondence in your name at your address, typically within 3 months.
- Phone verification: unlike OV where the phone number must appear in a business directory, IV phone verification can use your personal mobile number. The CA calls or sends a verification code to confirm the number is yours.
- Identity documentation review: the CA manually reviews your ID against the name and details on the order form. This typically takes 1 to 3 business days.
IV certificates are a different certificate type from OV. They carry the same Code Signing EKU and the same cryptographic properties. Software signed with an IV certificate verifies correctly on Windows, passes signtool verify, and satisfies the same integrity guarantees as software signed with an OV certificate. The difference is entirely in what identity is asserted: individual vs organizational.
What users see with an IV certificate
In the UAC dialog when running a signed installer, the ‘Verified publisher’ field shows your full name as it appears on your government ID. For some individuals this is exactly right : open-source developers, researchers, and consultants who are their own brand may prefer their personal name to appear. For others who want professional credibility with enterprise buyers, a business name is preferable, which is where Path 2 applies.
Path 2: Register a Minimal Legal Entity for OV
In most jurisdictions, registering as a sole trader or filing a DBA (Doing Business As) business name registration creates a legal entity or trade name that satisfies OV validation requirements. This is typically a simple administrative process that costs between $20 and $150 depending on the jurisdiction, takes a few days to a few weeks to process, and requires no accounting, incorporation, or ongoing compliance beyond periodic renewal.
The resulting OV certificate displays your registered business name in the Subject’s Organization field. When users run your software, the UAC dialog shows the business name rather than your personal name. For commercial software publishers, this typically looks more professional and more credible to enterprise IT departments evaluating software vendors.
Registration options by jurisdiction
| Country | Registration type | Cost | Time | Notes |
| United States | DBA (Doing Business As) / Fictitious Business Name with county or state | $20-$100 | Days to 2 weeks | Requirements vary by state. Not required in some states to use a business name. Check your state’s Secretary of State website. |
| United Kingdom | Register as a sole trader with HMRC; optionally register a trading name | Free (HMRC registration); ~$14 for a Companies House name registration | Same day to 2 weeks | Sole traders can trade under their own name without registration, but a registered trading name looks more professional and appears in verifiable directories. |
| Australia | Register an ABN (Australian Business Number) and optionally a business name with ASIC | ABN is free; business name registration ~AU$44/year | ABN same day; business name 2-3 days | An ABN alone may satisfy OV requirements with some CAs; a registered business name makes validation cleaner. |
| Canada | Register with provincial registry (varies by province) | $60-$200 CAD | Days to 2 weeks | Requirements vary significantly by province. Check your province’s business registry. |
| Germany | Gewerbeanmeldung (business registration) at local Gewerbeamt | ~$15-$65 | Days | Required for all self-employed professionals. Creates an entry verifiable by CAs. |
Before ordering an OV certificate after registering, check that your registered business name appears in a publicly searchable database and that the address listed matches what you will put on the certificate order. CAs verify against these public sources. A registration that hasn’t propagated to publicly accessible databases yet may require you to provide documentation directly to the CA.
IV vs OV With Minimal Registration: Which to Choose
| Factor | IV (Individual Validation) | OV (with registered entity) |
| Publisher name in UAC | Your personal full name | Your registered business or trading name |
| Validation time | 1-3 business days | 1-3 days after registration is searchable in public databases (add registration time) |
| Administrative overhead | None beyond the certificate process | Registration required; ongoing renewal of business name in some jurisdictions |
| Cost before certificate | None | $20-$150 registration (varies by jurisdiction) |
| Credibility to enterprise buyers | Personal name visible; may be less familiar to procurement | Business name visible; more consistent with how software vendors present themselves |
| CA availability | SSL.com; limited options | All major CAs (Sectigo, DigiCert, SSL.com, GlobalSign) |
| Right for | Open-source contributors, researchers, personal projects, developers who want their name attached to their work | Commercial software publishers, contractors supplying software to enterprises, anyone who wants a professional business identity on their signed software |
A Note on EV: Not Available for Individuals
Extended Validation (EV) code signing requires a formally incorporated entity : a limited company, LLC, corporation, or equivalent. Sole traders, DBA registrations, and individual developers cannot obtain EV certificates regardless of revenue or business history. EV validation requires verification of corporate officers, business category (private organization, government entity, or business entity), and jurisdiction of incorporation fields that have no equivalent for unincorporated individuals.
The practical significance is limited. EV was formerly sought for its SmartScreen reputation bypass on Windows, but Microsoft removed that bypass in August 2024. OV and EV now build SmartScreen reputation identically. EV remains required only for kernel-mode Windows driver signing and WHQL certification. Freelancers and solo developers who are not building kernel-mode drivers have no need for EV and should not be considering it.
Microsoft Trusted Signing: An Alternative Worth Checking
Microsoft Trusted Signing is a cloud-based signing service with lighter onboarding requirements than traditional OV validation in some respects. While the official eligibility criteria specify organizational accounts, individual developers and sole proprietors based in the US and Canada with at least 3 years of verifiable operating history have successfully enrolled using their individual or sole trader identity.
The service costs approximately $10 per month and produces signatures that Windows accepts for standard software distribution. It is not accepted for kernel-mode driver signing. For freelancers and solo developers who meet the geographic and operating history criteria, it represents the lowest-cost path to a signed executable that passes Windows verification.
The practical approach: attempt enrollment and describe your situation accurately. Microsoft’s onboarding team reviews individual cases. If enrollment is declined, IV or OV with a registered entity are the reliable alternatives.
Practical Recommendation by Situation
- You want to sign software under your personal name and have no interest in a business identity: get an IV certificate from SSL.com. The validation is straightforward, the cost is comparable to OV, and your name appears on the software exactly as you want.
- You want a professional business name and your jurisdiction allows quick DBA/sole trader registration: register first (typically $20-100, a few days), then order an OV certificate. The total setup time is 2-3 weeks; the result is a certificate that displays a business name and is available from any major CA.
- You are in the US or Canada, have 3+ years of self-employment history, and want the lowest cost: attempt Microsoft Trusted Signing enrollment before anything else. If approved, $10/month is the lowest entry point available.
- You are building kernel-mode Windows drivers: you need EV, which requires a formally incorporated entity (LLC, Ltd, etc.). Register a proper company before pursuing EV. This is a non-trivial administrative step and is only warranted if driver signing is genuinely required.
Frequently Asked Questions
Can I put my personal name in the Organization field of an OV certificate?
No. The Organization field in an OV certificate is populated with a verified legal organizational name. Putting a personal name there would require OV validation to confirm that name as a legal entity, which it is not. CAs will reject OV applications where the Organization field contains an individual’s personal name without a corresponding legal entity registration. If you want a certificate that shows your personal name, that is the IV certificate type, which uses a different validation process designed for individuals.
Will users know whether my certificate is IV or OV?
The certificate type is visible in the certificate details (the Certification Path and certificate properties show the issuer and the certificate’s validation level), but most users do not examine certificate details. In the UAC dialog that users see when running your software, they see the publisher name from the Subject field. For OV that is a business name; for IV that is a personal name. Whether this distinction matters depends on your audience. Enterprise IT departments who evaluate software vendors may look more closely at the certificate than general consumers would.
Does a DBA or sole trader registration count as a ‘real company’ for OV validation?
For OV purposes, yes. OV validation verifies a legal organizational entity, and a registered DBA or sole trader trading name is a legal entity in most jurisdictions. The CA checks that the name appears in business registries and that the address and phone number are verifiable. A DBA registration with a county clerk, or a sole trader registration with HMRC in the UK, satisfies this requirement. What OV cannot verify is an unregistered personal business that has no public registration at all.
Gloria Bradford is a renowned expert in the field of encryption, widely recognized for her pioneering work in safeguarding digital information and communication. With a career spanning over two decades, she has played a pivotal role in shaping the landscape of cybersecurity and data protection.
Throughout her illustrious career, Gloria has occupied key roles in both private industry and government agencies. Her expertise has been instrumental in developing state-of-the-art encryption and code signing technologies that have fortified digital fortresses against the relentless tide of cyber threats.