Verified Logo & Email Blue Tick from
SGD (SG$)
Put your existing qualified HSM to work with Prime OV and Prime EV code signing certificates. Sign applications, installers, scripts, and drivers under a verified publisher identity, with the validation level that fits your organization and publishing needs.
The certificate price is only one part of the decision. Your practical cost also depends on whether you already have compliant key-storage hardware, need a token shipped, or require a cloud-based signing environment.
Prime OV and Prime EV are provisioned for use with an existing qualified HSM. The signing key is generated and remains protected inside hardware your organization already manages. That makes them a strong value for teams with suitable infrastructure already in place.
Both options protect the signing key in your existing HSM. The difference is the level of applicant validation and the publishing use case.
Verified publisher identity for applications, installers, scripts and other software releases.
Extended organization validation for teams that require a higher-assurance software publishing identity.
Start with the validation level your organization and distribution workflow require. Both products use the same existing-HSM deployment model.
| Consideration | Prime OV | Prime EV |
|---|---|---|
| Starting price | SG$252.73/year | SG$379.73/year |
| Validation level | Organization Validation | Extended Validation |
| Applicant eligibility | Organizations and eligible individuals | Verified organizations |
| Signing-key storage | Existing qualified HSM | Existing qualified HSM |
| Best suited to | Standard commercial software releases | Higher-assurance organizational workflows |
Use the way you plan to store and access the private key as the first filter.
Start with Prime OV or Prime EV. You can use your existing infrastructure without adding a shipped token to the order.
Review Comodo or Sectigo. Their OV and EV products support vendor-provided token delivery as well as qualified existing-HSM setups.
Consider DigiCert for a DigiCert-provided token, your qualified token or HSM, or a compatible cloud HSM workflow.
Use the dedicated Azure Key Vault OV or EV deployment pages to evaluate token-free signing and CI/CD integration.
Explore additional OV and EV certificates for token, HSM, and compatible cloud-HSM signing workflows.
Verified organization signing with token, HSM, or compatible cloud-HSM options.
Standard OV publisher verification with multi-year and flexible hardware options.
For businesses and eligible individuals that need token or existing-HSM signing.
EV-level verification with flexible token, HSM, and compatible cloud-HSM deployment.
Multi-year EV signing for enterprise and business-critical software releases.
Extended Validation for commercial software, firmware, and Windows driver signing.
A quick readiness check can prevent ordering a certificate that does not match your hardware or validation needs.
Confirm whether the applicant is an organization or an eligible individual developer.
Select the validation level required for your publishing and compliance workflow.
Verify that the available HSM meets the CA’s security and enrollment requirements.
Identify the workstations, build servers and signing tools that need controlled key access.
Compare the annual rate and full amount payable for the selected multi-year plan.
Account for hardware, shipping or cloud-service costs that sit outside the certificate price.
A lower certificate rate is not useful if the product requires hardware your team does not have.
Check the complete subscription amount, token or shipping fees, and any infrastructure costs.
OV and EV software build reputation over time. EV no longer provides an automatic SmartScreen bypass.
Check compatibility and validation requirements with SSL2BUY before you order.
Direct answers to the most common questions about choosing, validating, and provisioning a Prime Code Signing Certificate.
USD 
GBP 
CAD 
INR 
AUD 
