USD 
GBP 
CAD 
INR 
AUD 
SGD A code signing certificate is a digital certificate that links a verified software publisher to a public key used to verify digital signatures. The publisher uses the corresponding private key to sign software. When that software is downloaded or installed, a compatible system can verify who signed it and detect whether the signed content has changed since signing.
What is a Code Signing Certificate?
A code signing certificate is a digital credential that lets software publishers prove their identity and verify that their code has not been modified after signing. It connects a verified publisher’s identity with a cryptographic key used to create and validate digital signatures. A Certificate Authority (CA) issues the certificate after validating the applicant according to the requirements for that certificate.
The public key is included in the certificate, while the corresponding private key remains protected. This separation is fundamental to public key infrastructure (PKI): the public key can be distributed for signature verification without giving recipients the private key needed to create signatures.
This is why a code signing certificate alone cannot sign software. Signing requires access to the private key corresponding to the public key in the certificate.
During verification, the certificate provides the identity and public-key information needed to evaluate trust in the signer.
What Information Does a Code Signing Certificate Contain?
A code signing certificate contains the identity and public-key information needed to associate a signing key with its publisher and evaluate the certificate’s trust. As an X.509 digital certificate, it typically includes:
- Subject information — identifies the certificate holder or publisher.
- Public key — corresponds to the private key used during signing.
- Issuer — identifies the Certificate Authority that issued the certificate.
- Validity period — specifies when the certificate is valid.
- Serial number — uniquely identifies the certificate for the issuer.
- Certificate extensions — specify additional properties and permitted uses, including code-signing usage where applicable.
- CA signature — allows the certificate to be authenticated as issued by the CA.
What is Code Signing?
Code signing is the process of applying a cryptographic digital signature to software so that its publisher can be authenticated and changes to the signed code can be detected. It uses public key cryptography, a digital certificate, and a cryptographic hash to establish this verifiable connection between a publisher and a software release.
| Component | What it does |
|---|---|
| Code signing | The process of digitally signing software |
| Code signing certificate | Links a verified publisher identity to a public key |
| Private key | Creates the publisher’s digital signature |
| Digital signature | Provides cryptographic evidence used to authenticate the signer and detect changes to signed content |
Together, these components create a sign-and-verify process: the publisher creates the signature, and the recipient later checks the signature and signed content.
How Does Code Signing Work?
Code signing uses Public Key Infrastructure (PKI) and asymmetric cryptography to apply a digital signature to software so recipients can verify who signed it and detect whether the signed content has changed. During signing, a cryptographic hash of the software is created, and the publisher’s protected private key is used to sign the resulting digest. The corresponding public key, contained in the code signing certificate, is used during verification.
The Publisher Establishes a Signing Identity
For publicly trusted code signing, the publisher first needs a validated certificate and access to the corresponding private key, protected using cryptographic hardware validated to FIPS 140-2 or an accepted equivalent. Once the signing identity and key setup are ready, the software can be signed.
The Software Is Hashed
When a release is ready to be signed, the signing tool applies a cryptographic hash function to the content covered by the signature.
The result is a message digest – a fixed-length value representing that content. If the covered content changes after signing, recalculating the hash produces a different digest. It makes post-signing modifications detectable.
The Private Key Signs the Digest
The publisher’s protected private key is used to perform the cryptographic signing operation over the digest. The result is the digital signature associated with the software.
It is common to describe this as “encrypting the hash with the private key,” but that explanation does not apply universally to digital-signature algorithms. More precisely, the private key signs the digest, and the corresponding public key is used during signature verification.
The Signature is Associated with the Software
The digital signature and the certificate information needed for verification are then embedded, attached, or otherwise associated with the software according to the platform’s signing format.
The exact structure varies by ecosystem. For example, some formats embed signatures directly in the signed file, while others can use separately signed catalogs or package-specific signature structures.
A Trusted Timestamp is Added
The signing process can also request a timestamp from a trusted timestamp service. The timestamp provides evidence that the signature existed at a particular time, which can later help determine whether the software was signed while the publisher’s certificate was valid.
The Recipient Verifies the Signed Software
When the software is checked, the verifier uses the public key associated with the signing certificate to verify the digital signature and checks whether the signed content still produces the expected digest.
If those cryptographic checks succeed, the verifier has evidence that the signature was created using the corresponding private key and that the content covered by the signature has not changed. Certificate trust, status, timestamps, and platform-specific policies can then be evaluated separately.
What Are the Benefits of Code Signing?
The main benefits of code signing are publisher authentication and software integrity. A code signing certificate helps establish the identity behind a software signature, while the digital signature provides cryptographic evidence that the signed content has not changed.
Publisher Authentication
A trusted code signing certificate associates a validated publisher identity with the public key used during signature verification. The issuing CA’s signature on the certificate allows a verifier to evaluate that identity through an established certificate chain.
When the software signature and certificate trust are successfully validated, the recipient has cryptographic evidence linking the signed software to the corresponding signing identity. How that identity is displayed depends on the operating system or software platform.
Software Integrity
A digital signature provides evidence that the content covered by the signature remains intact after signing. If that content is modified or corrupted, the cryptographic verification no longer matches the original signed state, causing signature verification to fail.
Code signing therefore provides tamper evidence, not tamper prevention. It cannot stop someone from modifying a file; it allows changes to the signed content to be detected when the signature is verified.
Does Code Signing Mean Software is Safe?
No. A valid code signature does not prove that software is malware-free, vulnerability-free, bug-free, or otherwise safe to run. It establishes information about the signer and whether the content covered by the signature has changed.
Legitimate publishers can unintentionally sign vulnerable software, and a compromised signing key may be abused to sign malicious code. A valid signature therefore answers “Who signed this?” and “Has the signed content changed?” – not “Is this software safe?”
Code signing should work alongside secure development, testing, malware detection, access controls, and other software supply-chain security measures rather than replace them.
Code Signing Certificate vs. Digital Signature: What’s the Difference?
A code signing certificate is a digital credential that associates a verified publisher identity with a public key, while a digital signature is the cryptographic evidence created when the corresponding private key is used to sign software. The certificate helps establish who controls the signing identity; the digital signature allows the signer and integrity of the signed content to be verified.
| Code Signing Certificate | Digital Signature | |
|---|---|---|
| What is it? | A digital credential associating a publisher with a public key | Cryptographic evidence created during signing |
| Created by | Certificate Authority | Signing operation using the publisher’s private key |
| Associated with | Publisher identity and public key | Specific signed software/content |
| Main role | Supports verification of the signing identity | Supports verification of signer authenticity and content integrity |
| Scope | Used for software and other code-signing-supported artifacts | Used in many digital-signature contexts, including software |
| Can it sign software by itself? | No | It is the result of signing, not a signing key |
In practical terms, the certificate establishes the identity associated with the signing key, while the digital signature provides the cryptographic evidence tied to the signed software.
What Happens When Signed Software Is Verified?
When signed software is verified, the system checks the digital signature and signed content, evaluates the certificate used to establish trust in the signing key, and applies any additional platform-specific policies. A signature can be cryptographically valid without automatically satisfying every trust or execution requirement.
Cryptographic Signature and Integrity
The verifier compares the cryptographic result with the digest calculated from the signed software. If the signed content has changed, the values no longer correspond, and signature verification fails.
A successful check provides evidence that the signed content remains unchanged from the state covered by the original signature.
Certificate Trust and Status
A valid cryptographic signature is only part of the trust decision. The verifier also evaluates the signing certificate to establish the identity associated with the signing key and whether the certificate chains to a trusted root. It may also check whether the certificate was valid at the relevant signing time, permits code signing, and has been revoked or otherwise distrusted.
A trusted timestamp can affect how certificate validity is evaluated after the signing certificate expires.
Platform-Specific Policy
Operating systems and software ecosystems can apply additional requirements after the cryptographic and certificate checks. These may determine whether the software is accepted, warned about, blocked, or subject to another platform-specific process.
A valid signature does not automatically mean the platform will allow the software to run.
Why Does the Code Signing Private Key Need Strong Protection?
The code signing private key needs strong protection because anyone who gains unauthorized access to it may be able to sign malicious or unauthorized software that appears to come from the legitimate publisher.
The private key represents the publisher’s signing authority. Unlike the public key in the certificate, it must remain protected from unauthorized access and use. A compromised signing key can therefore undermine trust in software released under that publisher’s identity.
For publicly trusted code signing certificates, strong key protection is now an industry baseline rather than an EV-only feature. CA/Browser Forum requirements effective since June 1, 2023 require subscriber private keys to be generated, stored, and used within suitable hardware-backed cryptographic protection. Depending on the signing model, this can be implemented through compliant hardware, cloud-based key protection, or a qualifying signing service.
What Role Does Timestamping Play in Code Signing?
Timestamping in code signing makes a digital signature trusted and valid even after the original code-signing certificate has expired; it shows that a digital signature existed at a particular time.
Without a trusted timestamp, certificate expiration can make it harder for a verifier to establish that the signature was created while the certificate was valid. With an accepted timestamp, correctly signed software can continue to verify after the signing certificate itself has expired, subject to the platform’s validation rules.
The three elements answer different trust questions:
- certificate establishes the signing identity
- digital signature provides evidence tied to the signed content
- trusted timestamp establishes when that signature existed.
What Types of Files Can Be Code Signed?
Code signing can be used with many types of software, including executables, libraries, installers, scripts, drivers, and application packages. The certificate requirements, signature format, and signing tool depend on the platform and type of software being signed.
| Software type | Common examples |
|---|---|
| Executables and libraries | EXE, DLL |
| Installers and packages | MSI, MSIX and other supported package formats |
| Scripts | PowerShell and other signable script formats |
| Java applications/packages | JAR |
| Microsoft Office code | VBA projects and macros |
| Drivers | Driver packages and signed catalog files |
| Software releases and updates | Platform-supported release or update packages |
These artifacts do not all use the same signing format or tool. Windows Authenticode, Java signing, Office/VBA signing, driver signing, and other software ecosystems have their own requirements. A publisher therefore needs to use the signing method supported by the software and target platform.
Are There Different Types of Code Signing Certificates?
Publicly trusted code signing certificates are separated into two types based on validation levels: Organization Validation (OV) and Extended Validation (EV).
Both OV and EV certificates associate a validated organization with a signing identity, while EV involves additional validation requirements. The distinction is primarily about validation and not whether basic private-key protection matters. The right validation level depends on the publisher’s requirements and target environment.
Frequently Asked Questions
Who Issues Code Signing Certificates?
Publicly trusted code signing certificates are issued by Certificate Authorities (CAs) after validating the applicant according to applicable code signing requirements. The CA issues a certificate that associates the validated publisher identity with a public key used during signature verification.
Who Needs a Code Signing Certificate?
Software publishers that need to establish a verifiable publisher identity and allow recipients to verify the integrity of distributed code may need a code signing certificate. Common use cases include Windows applications, installers, libraries, drivers, scripts, enterprise software, and other downloadable software artifacts.
Can One Code Signing Certificate Sign Multiple Applications?
A code signing certificate can generally be used to sign multiple applications released by the same validated publisher, provided the certificate and signing setup meet the requirements of those applications and target platforms. Organizations may still separate signing keys or identities across products, teams, or release environments for security and operational reasons.
Does Code Signing Encrypt Software?
Code signing does not encrypt the software or hide its contents. It creates a digital signature that allows the signer and integrity of the signed content to be verified. Encryption protects confidentiality. Code signing supports authentication and integrity. The two use related cryptographic technologies, but they solve different problems.
Need a Code Signing Certificate?
If you’re ready to choose a certificate, compare current code signing certificate options by validation type, signing setup, and software requirements.
