Best code signing certificate (2026)

For most developers in 2026 the best code signing certificate is OV with cloud signing: the key must stay in hardware, and cloud signing spares CI a USB token. The cheapest we verified on 10 November 2026 was SSL.com OV Code Signing at $129.00 a year; Sectigo ($345.00) and DigiCert ($438.24) cost more. Buy EV only when required.

What changed in June 2023

Since 1 June 2023 the CA/Browser Forum Code Signing Baseline Requirements oblige CAs to ensure that the subscriber's private key is generated, stored and used in a hardware crypto module meeting FIPS 140-2 Level 2 or Common Criteria EAL 4+ (or better). In practice you have three options:

1. A USB token shipped by the CA. Simple for one developer on one machine; awkward for CI servers and remote teams.
2. Your own HSM, on premises or a cloud HSM service, with key attestation the CA accepts.
3. The CA's or a platform's cloud signing service, where the key lives in the provider's HSM and you sign over an API.

Verified prices

SSL.com OV Code Signing was the cheapest certificate at $129.00 and DigiCert EV Code Signing the most expensive at $617.52 (1-year prices on 10 November 2026, before key storage):

Add key storage: The SSL Store lists a token with US shipping for $90 with Sectigo and $120 with DigiCert; SSL.com lists a YubiKey FIPS token for $379 or an eSigner subscription. SSL.com's EV certificate drops to $149.00 per year on a 5-year subscription, the steepest multi-year reduction in our data.

Cloud signing options

Three cloud services keep the key in the provider's HSM and sign over an API:

• SSL.com eSigner. Cloud HSM (FIPS 140-2 Level 3, per SSL.com) with a REST API and CI integrations, sold as a subscription on top of an SSL.com certificate.
• DigiCert KeyLocker. DigiCert's cloud key storage and signing for its code signing certificates.
• Microsoft Artifact Signing (formerly Trusted Signing). A fully managed Azure service: Microsoft validates your identity and manages certificates and keys in FIPS 140-3 Level 3 HSMs, with Basic (5,000 signatures a month) and Premium (100,000) tiers. Check Microsoft's eligibility rules before relying on it.

Which one to choose

OV with cloud signing fits most teams; tokens and EV fit narrower cases.

• Solo developer, occasional releases: SSL.com OV with eSigner, or a token if you sign on one machine.
• Team with CI/CD: cloud signing (eSigner, KeyLocker or Artifact Signing), so no physical token sits in a build server.
• Enterprise already on DigiCert or Sectigo: stay with that CA's platform; the higher certificate price buys account management you may already use.
• EV required: compare SSL.com EV ($349.00) and Sectigo EV ($453.00) first, and confirm the key storage meets the platform's rules. SSL.com itself warns that a YubiKey-held EV key may not satisfy every requirement, such as kernel-mode driver signing.