# Best code signing certificate in 2026: OV, EV, cloud signing

> Since June 2023 code signing keys must live in hardware or a cloud HSM. Compare OV and EV certificates, token vs cloud signing, and verified 2026 prices.

Source: https://ssl.sh/compare/best-code-signing-certificate/
Last updated: 2026-11-10

For most developers in 2026 the best code signing certificate is OV with cloud signing: the key must stay in hardware, and cloud signing spares CI a USB token. The cheapest we verified on 10 November 2026 was **SSL.com OV Code Signing at $129.00 a year**; Sectigo ($345.00) and DigiCert ($438.24) cost more. Buy EV only when required.

## What changed in June 2023

Since 1 June 2023 the CA/Browser Forum Code Signing Baseline Requirements oblige CAs to ensure that the subscriber's private key is generated, stored and used in a hardware crypto module meeting FIPS 140-2 Level 2 or Common Criteria EAL 4+ (or better). In practice you have three options:

1. **A USB token shipped by the CA.** Simple for one developer on one machine; awkward for CI servers and remote teams.
2. **Your own HSM**, on premises or a cloud HSM service, with key attestation the CA accepts.
3. **The CA's or a platform's cloud signing service**, where the key lives in the provider's HSM and you sign over an API.

## Verified prices

SSL.com OV Code Signing was the cheapest certificate at $129.00 and DigiCert EV Code Signing the most expensive at $617.52 (1-year prices on 10 November 2026, before key storage):

| Certificate | Validation | Cheapest seller | 1-year price |
|---|---|---|---|
| [SSL.com OV Code Signing](https://ssl.sh/certificates/ssl-com-code-signing/) | OV | SSL.com | $129.00 |
| [Sectigo Code Signing](https://ssl.sh/certificates/sectigo-code-signing/) | OV | GoGetSSL / The SSL Store | $345.00 |
| [SSL.com EV Code Signing](https://ssl.sh/certificates/ssl-com-ev-code-signing/) | EV | SSL.com | $349.00 |
| [DigiCert Code Signing](https://ssl.sh/certificates/digicert-code-signing/) | OV | GoGetSSL / The SSL Store | $438.24 |
| [Sectigo EV Code Signing](https://ssl.sh/certificates/sectigo-ev-code-signing/) | EV | GoGetSSL / The SSL Store | $453.00 |
| [DigiCert EV Code Signing](https://ssl.sh/certificates/digicert-ev-code-signing/) | EV | GoGetSSL / The SSL Store | $617.52 |

Add key storage: The SSL Store lists a token with US shipping for $90 with Sectigo and $120 with DigiCert; SSL.com lists a YubiKey FIPS token for $379 or an eSigner subscription. SSL.com's EV certificate drops to $149.00 per year on a 5-year subscription, the steepest multi-year reduction in our data.

## Cloud signing options

Three cloud services keep the key in the provider's HSM and sign over an API:

- **SSL.com eSigner.** Cloud HSM (FIPS 140-2 Level 3, per SSL.com) with a REST API and CI integrations, sold as a subscription on top of an SSL.com certificate.
- **DigiCert KeyLocker.** DigiCert's cloud key storage and signing for its code signing certificates.
- **Microsoft Artifact Signing** (formerly Trusted Signing). A fully managed Azure service: Microsoft validates your identity and manages certificates and keys in FIPS 140-3 Level 3 HSMs, with Basic (5,000 signatures a month) and Premium (100,000) tiers. Check Microsoft's eligibility rules before relying on it.

## Which one to choose

OV with cloud signing fits most teams; tokens and EV fit narrower cases.

- **Solo developer, occasional releases:** SSL.com OV with eSigner, or a token if you sign on one machine.
- **Team with CI/CD:** cloud signing (eSigner, KeyLocker or Artifact Signing), so no physical token sits in a build server.
- **Enterprise already on DigiCert or Sectigo:** stay with that CA's platform; the higher certificate price buys account management you may already use.
- **EV required:** compare SSL.com EV ($349.00) and Sectigo EV ($453.00) first, and confirm the key storage meets the platform's rules. SSL.com itself warns that a YubiKey-held EV key may not satisfy every requirement, such as kernel-mode driver signing.