DigiCert OV Code Signing Certificate
Verify your organization's identity when signing software, installers, libraries, scripts and other supported code. DigiCert's current standard Code Signing product uses CS Organization Validation and supports compliant hardware tokens, HSM and KeyLocker provisioning.
Starting price for DigiCert Code Signing when using your own compliant hardware token or HSM. Prices are subject to change.
Check Current DigiCert Pricing →What Is DigiCert OV Code Signing?
The DigiCert OV Code Signing Certificate verifies the identity of the organization publishing software and helps recipients establish that signed code comes from the stated publisher and has not been modified after signing.
DigiCert's current terminology describes this as its standard Code Signing product using CS Organization Validation. Teams comparing vendors can also review the broader DigiCert certificate range before selecting a configuration. The product is intended for software companies, independent software vendors and organizations distributing applications, installers, libraries, scripts and other supported software.
Organization Validation
DigiCert verifies the organization before issuing the standard Code Signing certificate.
Publisher Identity
The certificate associates signed software with the validated organization in supported software and operating system environments.
Protected Private Key
The private key must remain on compliant cryptographic hardware rather than being provided as an ordinary downloadable private key.
Timestamping
Timestamping helps a signature remain verifiable after the signing certificate itself expires, assuming the signature and timestamp remain valid.
CertCentral
DigiCert CertCentral provides certificate management for the Code Signing certificate.
CI/CD Compatibility
DigiCert supports signing integrations and environments including Azure DevOps, CircleCI, GitLab, Jenkins, Gradle, Apache Ant and Maven.
DigiCert OV Code Signing Price
The certificate price depends on how the private key is provisioned and stored. If you are weighing other certificate types as well, the code signing certificate comparison brings the main options together. The main product price should be presented as the starting configuration rather than implying that every deployment costs the same.
| Configuration | Current DigiCert price | Best suited for |
|---|---|---|
| Code Signing + Own Token | $696 / year | Organizations that already have compliant signing hardware |
| Code Signing + HSM | $696 / year | Centralized signing infrastructure and automated release workflows |
| Code Signing + DigiCert USB Token | $840 / year | Organizations that need DigiCert to supply the hardware token |
| Code Signing + KeyLocker | $996 / year | Teams wanting cloud based key storage and centralized signing |
Compare DigiCert OV with EV
Choose based on validation requirements, key protection and the signing workflow you need to support, rather than price alone.
DigiCert OV Code Signing Key Storage Options
The certificate and the private key storage method should be considered together when selecting the right Code Signing setup. For teams choosing cloud-managed key storage, DigiCert KeyLocker is a distinct signing option rather than a separate validation level.
Use Your Own Hardware Token
If you already have an eligible compliant cryptographic device, DigiCert allows the certificate to be provisioned to your own token.
This is a practical option for organizations that already operate compliant signing hardware.
DigiCert USB Token
DigiCert can supply a hardware token with the subscription when an organization does not already have an eligible signing device.
The private key remains protected by the hardware rather than being provided as an ordinary downloadable private key.
HSM
Organizations with centralized signing infrastructure can use a supported HSM for key protection and signing.
This can be suitable for larger development teams, automated release pipelines and centralized key management environments.
DigiCert KeyLocker
KeyLocker provides cloud based key storage and signing through DigiCert's platform.
DigiCert's current comparison includes 1,000 signings per year with the Code Signing + KeyLocker option and FIPS 140-2 cloud key storage and signing.
DigiCert OV Code Signing Certificate Specifications
- Certificate typeCode Signing
- ValidationOrganization Validation
- DigiCert validation typeCS Organization Validation
- Starting price$696 / year
- DigiCert supplied token$840 / year
- HSM option$696 / year
- KeyLocker option$996 / year
- Subscription12 month auto renewing
- Maximum certificate validity459 days
- Private keyHardware protected
- Minimum key protectionFIPS 140-2 Level 2 / Common Criteria EAL4+ or equivalent
- Private key exportNot permitted from certified devices
- ManagementDigiCert CertCentral
- TimestampingSupported
- CI/CDSupported
- AuthenticodeSupported
How DigiCert OV Code Signing Works
The signing workflow combines your software, a protected private key, the DigiCert certificate and a trusted timestamp.
What Can You Sign With DigiCert OV Code Signing?
DigiCert lists broad Code Signing compatibility, including Microsoft Authenticode and other supported signing environments.
Windows Applications
EXE and DLL files and other supported Windows binaries can be signed using Microsoft's Authenticode signing workflow.
Installers
Windows installers and packages can be signed to establish publisher identity and protect software integrity.
Java
Java applications and JAR files can be signed using supported Java signing tools and workflows.
PowerShell
Supported scripts can be signed using PowerShell's Code Signing mechanisms.
CI/CD Releases
Organizations can integrate signing into automated release workflows using supported DigiCert provisioning and signing solutions.
Kernel Mode Signing
DigiCert lists kernel mode signing compatibility for applicable signing workflows and requirements.
DigiCert OV vs EV Code Signing
The important distinction is the validation requirement and workflow, not simply that EV is a higher validation level. Compare the requirements side by side in this OV versus EV code signing guide.
| Feature | DigiCert OV | DigiCert EV |
|---|---|---|
| Organization validation | Yes | Yes |
| Extended Validation | No | Yes |
| Current starting price | $696/year | $972/year |
| Own token / HSM | Yes | Yes |
| KeyLocker | Available | Available |
| Current maximum validity | 459 days | 459 days |
| General software signing | Yes | Yes |
| Additional EV validation | No | Yes |
| Windows driver requirements | Depends on workflow | EV supports applicable requirements |
Important: Do not choose EV simply because it sounds more trusted. Choose EV when the additional validation or a specific signing workflow requires it.
DigiCert OV Code Signing Validity and Validation
459 day maximum validity: Since February 24, 2026, DigiCert no longer issues public Code Signing certificates with validity exceeding 459 days. DigiCert also stopped issuing new two and three year public Code Signing certificates.
CS Organization Validation: Before issuance, the organization must complete the required Code Signing validation. DigiCert's current documentation specifies CS Organization Validation for standard Code Signing.
Do not confuse a subscription or order arrangement with the validity period of an individual issued certificate.
Who Should Buy DigiCert OV Code Signing?
Software Companies
Organizations distributing commercial desktop or server software and wanting publisher identity associated with their organization.
SaaS Companies With Downloadable Software
SaaS companies distributing desktop clients, agents, installers or utilities can incorporate Code Signing into their software release process.
Independent Software Vendors
ISVs can use organization validated Code Signing to establish the publisher identity associated with their software.
Enterprise Development Teams
Enterprises can use hardware tokens, HSMs or KeyLocker depending on their signing architecture and release controls.
CI/CD Teams
Organizations automating releases should consider signing infrastructure as carefully as the certificate itself.
Organizations Without an EV Requirement
OV is a practical choice when you need organization validated publisher identity but do not have a specific EV requirement.
DigiCert OV Code Signing vs KeyLocker
KeyLocker is a signing and key storage option, not a separate validation level.
DigiCert OV Code Signing
The certificate provides organization validated Code Signing. The private key can be provisioned using supported hardware or HSM methods.
Code Signing + KeyLocker
The Code Signing capability is combined with DigiCert's cloud based key storage and signing service. The current listed configuration is $996/year.
For Automated Releases
KeyLocker can be relevant when centralized signing is more practical than manually using a physical token attached to a build machine.
Does DigiCert OV Code Signing Remove SmartScreen Warnings?
No certificate should be presented as a guaranteed SmartScreen bypass. Code Signing establishes publisher identity and software integrity, but it does not guarantee that Windows SmartScreen will never display a warning.
Older DigiCert marketing material may describe EV in relation to SmartScreen reputation. Those historical claims should not be carried into this current product page without qualification.
Frequently Asked Questions
What is DigiCert OV Code Signing Certificate?
It is DigiCert's standard public Code Signing certificate using CS Organization Validation to verify the organization publishing the software.
How much does DigiCert OV Code Signing cost?
The current DigiCert price is $696 USD for a 12 month subscription when using your own compliant hardware token or HSM. DigiCert lists $840/year when a USB token is supplied and $996/year for Code Signing + KeyLocker.
Can I use my own hardware token?
Yes, provided the token meets DigiCert's current cryptographic hardware requirements.
Does DigiCert provide a hardware token?
Yes. DigiCert currently lists a Code Signing configuration with a supplied USB token for $840/year.
Does DigiCert support HSM for Code Signing?
Yes. DigiCert lists HSM as a supported provisioning method, and its current standard Code Signing HSM price is $696/year.
Can DigiCert OV Code Signing be used with CI/CD?
Yes. DigiCert supports Code Signing integrations with environments such as Azure DevOps, CircleCI, GitLab and Jenkins.
How long is a DigiCert OV Code Signing Certificate valid?
The current maximum validity for a public DigiCert Code Signing certificate is 459 days. DigiCert no longer issues new two or three year public Code Signing certificates.
Can I download the private key as a PFX file?
No. DigiCert requires Code Signing private keys to remain on compliant cryptographic hardware, and private key export from certified devices is not permitted.
Is DigiCert OV the same as DigiCert EV?
No. Standard DigiCert Code Signing uses CS Organization Validation, while EV Code Signing uses Extended Validation and has additional validation requirements.
DigiCert OV Code Signing Certificate
Check the current DigiCert configuration, pricing and provisioning options before ordering.
Compare OV and EV options