Code signing certificate prices in 2026 compared
Code signing certificate prices vary by a factor of five or more for what is, cryptographically, the same thing: a publicly trusted certificate that puts your verified organisation name on Windows installers, drivers and scripts. The difference comes from brand, validation level, key storage (USB token, cloud service or your own HSM) and term. This guide compares the published list prices of the main certificate authorities, then works out a three-year total cost for the token route and the cloud route. All prices are in USD unless marked otherwise, were taken from each vendor's own pages, and were checked in October 2026.
Two rule changes that affect what you are buying
The 460-day validity limit (CA/B Forum Ballot CSC-31)
CA/Browser Forum Ballot CSC-31 cut the maximum validity of publicly trusted code signing certificates from 39 months to 460 days for certificates issued on or after 1 March 2026. Several CAs build in a few days of headroom, so you will see 458 or 459 days on actual certificates, and some started applying the shorter lifetime a little earlier (Sectigo and Certum both refer to late February 2026). GlobalSign now sells only 1-year (366-day) code signing certificates.
Multi-year plans still exist at SSL.com, Sectigo and Certum, but they are no longer one long certificate. You pay once for the term and receive a new certificate (a re-issue) roughly every year, after a fresh key generation on your token or HSM. We explain the mechanics in Code signing certificate 460-day validity.
EV no longer buys instant SmartScreen reputation
Until 2024, an EV certificate let a new installer skip the Microsoft Defender SmartScreen warning. Microsoft removed that behaviour in 2024. Its current guidance says EV-signed files now build reputation the same way as OV-signed files, and that paying the EV premium solely to avoid SmartScreen warnings is "no longer justified". EV is still required for some Windows Hardware Dev Center work (kernel-mode driver submission) and may matter for enterprise procurement. Treat any page still promising an EV SmartScreen bypass as out of date.
Published prices by vendor
The table shows the 1-year price and, where the vendor sells multi-year terms, the effective price per year for 2 and 3 years. "List" means the vendor's normal price; "discounted" means the page shows it as a reduction from a higher MSRP or list price.
| Vendor / product | 1 year | 2 years (per year) | 3 years (per year) | Key storage | Price type |
|---|---|---|---|---|---|
| SSL.com OV | $129.00 | $116.10 | $109.65 | YubiKey FIPS +$379.00, or eSigner subscription | List |
| SSL.com EV | $349.00 | $299.00 | $249.00 | YubiKey +$379.00 (SSL.com notes it may not meet kernel-driver needs), or eSigner | List |
| DigiCert OV (12-month auto-renewing) | $696 own token/HSM; $840 with DigiCert USB token; $996 with KeyLocker | Not offered on page | Token, KeyLocker cloud or own HSM | List | |
| DigiCert EV (12-month auto-renewing) | $972 own token/HSM; $1,116 with USB token; $1,272 with KeyLocker | Not offered on page | Token, KeyLocker cloud or own HSM | List | |
| GlobalSign OV | $529 token; $289 on your own HSM | 1-year only since 26 Dec 2025 | Token or own HSM | List | |
| GlobalSign EV | $669 token; $410 on your own HSM | 1-year only | Token or own HSM | List | |
| Sectigo OV / EV (direct) | Not published | "From $536.25 per year" on the 5-year plan | FIPS token shipped each year, included | Promotional (5-year deal) | |
| Certum Standard Code Signing in the Cloud | EUR 209 | EUR 159.50 | EUR 139.67 | SimplySign cloud, included | List (EUR) |
| Certum EV Code Signing in the Cloud | EUR 379 | EUR 299.50 | EUR 275 | SimplySign cloud, included | List (EUR) |
| Certum Standard / EV Code Signing set | from EUR 169 / from EUR 359 | 2 and 3-year terms sold, with free re-issues | Certum card and reader included | List (EUR) | |
SSL.com has the lowest published OV list price of the CAs and one of the steepest multi-year discounts on EV. DigiCert is the most expensive line by a wide margin, and is sold only as a 12-month subscription. Entrust is no longer an option for new public certificates: it completed the transfer of its public certificate business to Sectigo on 18 September 2025.
Cloud signing options and their fees
- SSL.com eSigner (OV/IV): monthly tiers from $20.00 for 20 signings up to $250.00 for 1,000 signings; annual plans are 25% cheaper ($180.00 per year for 240 signings at tier 1). Extra signings cost $1.00 down to $0.25 each by tier; extra credentials $20.00 per month.
- SSL.com eSigner (EV): monthly tiers from $100.00 for 10 signings to $1,500.00 for 10,000; annual from $900.00 per year for 120 signings. Extra EV credentials $29.00 per month.
- DigiCert KeyLocker: priced into the certificate subscription. The KeyLocker version costs $300 a year more than the own-token version for both OV and EV, and DigiCert's documentation states 1,000 signatures per certificate per year, with more sold in blocks of 1,000.
- GlobalSign: sells an "HSM implementation" at $289 (OV) and $410 (EV) for keys on your own FIPS or Common Criteria HSM, which can include cloud key services such as Azure Key Vault. The HSM or cloud KMS cost is yours on top.
- Sectigo: offers an HSM code signing certificate for your own hardware or cloud HSM (including Google Cloud KMS) through sales; no public price.
- Certum SimplySign: cloud key storage is built into the cloud products above, with signing approved from a mobile app.
- Microsoft Azure Artifact Signing (formerly Trusted Signing): Basic at $9.99 per month with 5,000 signatures and one certificate profile of each type; Premium at $99.99 per month with 100,000 signatures and ten profiles; $0.005 per signature above quota. The catch is eligibility: public-trust certificates are available only to organisations in the USA, Canada, the EU and the UK, and to individual developers in the USA and Canada. A Singapore company, or most of Asia, cannot use it today.
Three-year cost of ownership
The table below adds up three years of signing for one certificate. Assumptions: OV unless marked EV; the cheapest published multi-year rate where a vendor sells one, otherwise three 1-year purchases; one token bought once and reused for re-issues unless the vendor ships a new one; low signing volume that fits the smallest cloud tier. Certum is in EUR and Azure eligibility is limited, so treat those rows as reference.
| Route | Option | 3-year total | How it adds up |
|---|---|---|---|
| Token | SSL.com OV, 3-year plan + YubiKey | $707.95 | 3 x $109.65 + $379 |
| Token | GlobalSign OV | $1,587.00 | 3 x $529 |
| Token | DigiCert OV with USB token | $2,520.00 | 3 x $840 |
| Token | SSL.com EV, 3-year plan + YubiKey | $1,126.00 | 3 x $249 + $379 |
| Cloud | Azure Artifact Signing Basic (if eligible) | $359.64 | 36 x $9.99 |
| Cloud | Certum Standard Code Signing in the Cloud | EUR 419 | 3-year price, SimplySign included |
| Cloud | SSL.com OV + eSigner tier 1 annual | $868.95 | 3 x $109.65 + 3 x $180 (240 signings a year) |
| Cloud | GlobalSign OV on your own cloud HSM | $867.00 + KMS fees | 3 x $289 |
| Cloud | DigiCert OV with KeyLocker | $2,988.00 | 3 x $996 (1,000 signatures a year) |
| Cloud | SSL.com EV + eSigner EV tier 1 annual | $3,447.00 | 3 x $249 + 3 x $900 (120 signings a year) |
For a small team outside the Azure regions, the cheapest published routes are an SSL.com or Certum OV certificate, either on a token or (for Certum) in its bundled cloud. Cloud signing is convenient for CI pipelines but usually costs more over three years once per-signing fees are counted, especially for EV. The token route is cheaper at low and medium volumes, provided the token sits in a machine your build can reach.
How to choose
- If you are an organisation in the USA, Canada, the EU or the UK, price Azure Artifact Signing first.
- Elsewhere, buy OV unless you sign kernel drivers or a customer contract demands EV.
- Confirm whether a multi-year order includes a new token each year or reuses yours.
- Count every file you sign (each DLL counts) before choosing a per-signature cloud plan.
- Compare the full term, not the 1-year headline. Our guide to choosing a USB token and CA covers the compatibility side.
Buying through One Sign
Every certificate in this comparison, from SSL.com, DigiCert, GlobalSign, Sectigo and Certum, is available from One Sign. Plans run for 1, 2 or 3 years depending on the CA. Because each certificate is now capped at 460 days, it is re-issued free of charge each time it expires during the term; see Code signing certificate 460-day validity for how re-issues work.
- Key storage: we supply the hardware token, or you can use your own where the CA allows it. Our guide to choosing a USB token and CA explains the options.
- Automation from day one: each certificate comes with a free OneSigner Basic licence locked to that certificate, so you can sign builds automatically from the start.
- Quotes and orders: ask for a quote or order at onesign.sg/portal/certificates, or contact sales@onesign.sg.
Sources
Prices checked October 2026 on these pages: SSL.com OV ssl.com/products/software-integrity/code-signing/ov/; SSL.com EV ssl.com/products/software-integrity/code-signing/ev/; SSL.com eSigner ssl.com/guide/esigner-pricing-for-code-signing/; DigiCert digicert.com/signing/code-signing-certificates; DigiCert KeyLocker licensing docs.digicert.com; GlobalSign globalsign.com/en/code-signing-certificate and shop price list shop.globalsign.com; Sectigo sectigo.com/ssl-certificates-tls/code-signing; Certum shop.certum.eu/code-signing.html, standard cloud, EV cloud; Microsoft azure.microsoft.com/en-us/pricing/details/artifact-signing/ and learn.microsoft.com code signing options; Entrust entrust.com/tls-certificate-information-center. Prices change often and may exclude tax; confirm at checkout.