Windows EV code signing without hardware token?

I’ve recently had to go through the process of getting a new code signing certificate for Windows. Thanks to everyone who’s shared notes about this on the forum in recent years, that was very helpful… but, WOW!, was getting an EV code signing certificate from Sectigo a tedious process. It took ~4 weeks to get through the validation steps, and 8 weeks in total until the USB hardware token was delivered to me.

I’ve adapted my Windows installer creation scripts to work with the EV code signing certificate and signtool, but the signing steps require the USB hardware token to be connected. I’m fairly sure that the answer is going to be “you have to have the USB hardware token connected”, but does anyone know if it’s possible to create a signing process that doesn’t require the hardware token? I ask because having our installer build process dependent on a single piece of hardware feels awfully risky, especially considering how long it took Sectigo to ship the token to us once it had been approved.

If it’s not possible to sign without the hardware token, how do distributed teams handle this? A centralised build server? And is there any way of protecting against disaster scenarios, e.g. fire?

As far as I’m aware, that is not possible. I haven’t had to deal with hardware tokens personally, but I will come May. I’m definitely going to be getting a few months head start on the process. But it’s my understanding that the device must be present. It should be possible to have multiple devices however, so that you have a backup or if you need multiple signers. You’d have to talk to Sectigo about that.

1 Like

It’s done with an online code signing service called an HSM. We were in the process of switching to this when I left my last job, but it sounded like signing was going to be something like this:

  1. Generate a SHA256 hash of the items to be signed using a supplied app (IIRC we were using a specialized version of jsign)
  2. Send the hashes off to the HSM which signs the hashes and returns them.
  3. Specialized app applies the signature to the binary(ies)
1 Like

After the suggestion here in the forums from Thom M., about a month ago I went down the path of On a side note, as everyone says, give yourself lots of time to get through the process.

I just wrapped things up a week or so ago and there are lots of discoveries. Although I can’t say whether or not Sectigo’s products or offerings are the same, my guess is that they may offer something similar.

The first thing I discovered, is that after I got through the validation process, I was offered three solutions for getting my cert, one of them I was completely unaware of and wasn’t documented in’s marketing documentation. Of course, as Tom C. mentioned and others have spoken to in other threads, the first option is to pay for a USB token and have this shipped to you. Cost as of this writing from is $249 which seems rather pricey IMHO.

The second option that Greg talks to, is what calls Cloud Signing. This option includes a free 30-day trial but then moves into a subscription cost thereafter, which for an EV cert, looks to run $100 a month and only allows for 20 signings in this period before additional charges accumulate. This definitely makes the USB token appear to be a steal.

The third option, and the one I went with, is the ability to bring your own YubiKey FIPS token and go through an attestation process with where you can generate your certificate for your YubiKey token and install it. I was pleasantly surprised by to offer this option, especially as their marketing collateral never mentioned this as a possibility and I only found out about it once I was almost entirely through process. From my own internal testing, this mostly works fine (see one gotcha below), and I was pleasantly surprised to see my Inno Setup, or should I say signtool.exe, hit some OS level flag and get prompted by the OS for my PIN for signing via the token. Cost of this option was $80 directly from Yubico and forewarning that at least a week ago, if you tried to Amazon said key, I learned the hard way that you get a non-FIPS token which isn’t compatible with this process. During the purchase process, Yubico did recommend getting multiple keys so that you can have a backup. I personally did not, as, from what I can tell, only allows you to do attestation against a single token. But who knows, they might allow more than one in their backend system (as I believe they do for the $249 purchased version where you can buy multiple). Theoretically in the house burned down scenario, one could simply switch to the eSigner process temporarily or permanently, or just buy a new Yubikey and go through the attestation and certificate install process again.

One gotcha with this process that I wasn’t aware of, is if you’re using Microsoft Remote Desktop to access the Windows machine that has the token inserted, everything will fail. Even though you might have the smart card passthrough functionality turned off in your RDC session, something in Remote Desktop continues to latch on and make the token unavailable for use. After some online searches, the solution is to use VNC not MS Remote Desktop in this scenario. It’s a bit more of a hassle, but this works just fine.

Two other semi-related notes. I ended up going with instead of other vendors as they were one of the less expensive options and offer a “10 year cert”. Technically though it’s a 3-year cert that keeps renewing for 10 years.

The other thing to note, is that I called several times during the process to always have someone pick up the phone who was solely an answering service. I never once in my U.S. West Coast timeframe, get someone who picked up who didn’t want to take a message to have someone else contact me back later. I generally did get a response within 24 hours, but said individuals, from what I could tell, were not based in the U.S. as responses were in the 3AM-12PM Pacific timeframe. So although states they’re located in Houston, TX, be aware that your sole support lifeline will be via email, outside of the U.S. and generally not in U.S. working hours. This is also why I mentioned to give yourself lots of time, in my case weeks, to get through the process. Every support question/email has a one day turn around which means several days to get through an issue. For me personally, the process took just over a month, but in full transparency most of this time was simply working with Dun & Bradstreet to get my record correct for the validation process. Theoretically if you skipped the D&B validation process and did something like Google Business that supports, the whole process is likely to take 1-2 weeks if you’re a newbie.

Sorry for the novella and hope this helps Tom C. and others down the road.


That is excellent information! I just asked about bringing my own Yubikey, because why would I want to pay $250 for an $80 device? Even that $80 is high for what it is, in my opinion. Knowing that a 10 year renewal isn’t really a 10 year renewal is good info. Do you know if you have to go through the entire validation process every 3 years? And I’d expect to have to go through attestation process for each renewal, since you’re getting a new certificate. Probably a new key too, which will nuke your SmartScreen credibility. I expect the “not really ten years” makes such a long term purchase to be pointless, aside from saving money.

Edit: Oh and at the time of this writing, their code signing “buy” pages are broken. They are aware, so anybody looking to buy would have to wait.

Yes, agreed, but frankly I was thrilled to find out that I could just buy an $80 token key myself rather than spend another $249 for to send me one.

Yes and in retrospect all of this makes sense as certificate expirations keep getting shorter and shorter each generation/year. Sort of an odd case, other than for marketing in that I’m expecting to get a 3-year, 3-year, 3-year and a 1-year to span the 10-years.

Ah this is a great point Thom that I neglected to add clarity to. In my particular case, at the very last minute, I switched from an EV to an OV cert. based upon several factors. IIRC the EV cert was a max of 3-years and the cost was substantially higher per year than an OV cert. But even more burdensome, at least with’s process, every time you needed to renew your EV cert, you had to go through some process where your accountant has to write a letter to certify your identity, business, location, etc. From my understanding with the OV cert, you just need to have your business record up-to-date with D&B, Google Business, etc. and do a phone call verification at the beginning of the process to cover the entire 10-year span. Time is money and in the end I’m hopeful that the SmartScreen side of things won’t bite me too bad, especially if I upload my installer/binary to Microsoft in advance. Knowing how long it takes to just get the OV cert, I wasn’t looking forward to doing the same thing again and again every 3-years knowing how much of a distraction from business the process can be.

One more thing I neglected to touch on. Once I did get my signing cert and signed my .exe, I ran into one hiccup. Windows was fine with the signing and intermediary cert, but didn’t trust SSL’s root cert. In looking through certmgr, I could see one root cert, but it wasn’t the one in my trust chain. Coincidentally, I indeed did have the proper and others from them, in my system keychain on macOS, but of course that doesn’t help the situation. This was one of my queries to as to what was going on and how to proceed as the process should in no way require customers to download and install any part of the trust chain.

In the end, and before I recieved their response, I packed up my app with Inno Setup with signing. When I ran the installer, the missing root cert mysteriously appeared in my Trusted Root Certification Authorities so I’m assuming that Microsoft, in my case for Windows 11, has some background fetch when an installer is launched. didn’t know much about any of this and didn’t really offer any advice in this space.

Does anyone else know more about this scenario and how it happens?

When I was in contact with to get an EV certificate, this was not mentioned by the representative I was in contact with. They only wanted my D&B record to be correct, but after getting myself a D&B record it turns out used a third party service that only scraped their database every so often. My record didn’t show up because it was brand new, and I just gave up on the process since my current certificate was valid.

For an IV cert (OV but issued to you, an individual), you need only a valid driver’s license and a camera capable of selfies.

Ok, so a 10 year OV might actually be a 10 year? I guess I’ll ask them. I’m really just interested in keeping the SmartScreen reputation. I know EV is exempt from that, but I get enough downloads that my reputation is taken care of on the first day of release, then I never have to worry about it the rest of the life of the certificate. So why would I pay 4x more?

LOL! You guys are going to keep me going down all kinds of tangents and side quests here. :wink:

I can provide some more background to what you’re talking about Tim. In my particular case and because my business was incorporated a few years ago, there was already a D&B record for me. What was missing though, was a telephone number attached to said record.

After a bit of back and forth with D&B, this was resolved within 2-3 days. But heads up that although in my case this was done quickly, their official SLA is 12 business days.

Unfortunately, this didn’t solve the problem for as they said they still couldn’t see my telephone number. After lots of back and forth with them as well as D&B I was able to piece together the scenario and how all of this works.

D&B has a public facing DB that the DUNS Lookup Tool uses. But there’s also another D&B database/tool called “D&B Hoovers”. From what I can tell this tool has different login credentials and might be a pay offering. solely uses D&B Hoovers and will not use the DUNS Lookup Tool. The problem is that the public facing and this other (private facing?) Hoovers tool use completely different DBs. After a couple of conversations on the phone with D&B, these DBs don’t sync or replicate to each other and instead there’s some kind of monthly upgrade/batch upload process from the Lookup Tool to D&B Hoovers. By the time I found out about all of this, it had already been 2-3 weeks since my record update and in my case there was 1 week to go before this upgrade/batch upload was to happen. The rep. was able to go so far as to give me a precise date which happened to be over a weekend.

So in the end, I waited for the upgrade/batch upload to take place, then had check things on their end only for them to still not see the record update. After going back to D&B again, they were able to confirm it was in the D&B Hoovers DB including sending me a screenshot. The next day the folks looked again and all was fine with my record being updated.

Two things to note here. The first is hats off to D&B as they were always super easy to talk to and I could always get someone knowledgeable on the phone during U.S. business hours.

The second is that I specifically forced the D&B issue with Numerous times they offered up an alternative to just create a Google Business record and within 24 hours they could proceed (e.g. Google was instantaneous). I kept this potential in my back pocket so to speak, but ultimately wanted to get through the D&B process as this is the system of record for Apple as well. I just dug this out of my email and allows these other business records systems beyond D&B:

As always, I don’t mean to be so long winded and hope this helps folks.

P.S. One other thing I discovered was that D&B doesn’t much like Safari. Maybe its my privacy minded extensions I have installed, but Firefox was also an issue. D&B highly recommends using Google Chrome (pure, not IE for macOS) in order to get to their various web pages and tools.

Nope, as OV is what I have and I can confirm that you’ll only get 3 years at a time. Here’s verbatim from their email response to me on a query about the 10 years:

“Yes, we will reissue new certificate every 3 years as this is the maximum duration we can issue. You don’t need to repay for the entire 10 years duration.”

Also I can speak to the costs a bit more as well. For a 10-year OV certificate (or actually 10-years worth of certs) the cost was $645 or $64.50 per year (USD). I believe the screenshots on this page are accurate based upon my memory from a month ago, which caps you at 3-years for a total cost of $747 or $249 per year. Ten years of EV certs would therefore run $2,590 (note $747 * 3 + 1 year at $349 as not bought in bulk).

I’m not trying to persuade anyone here between one or the other, but at least for me personally, between the cost and time sink in the whole process across 10-years, I opted for the OV path. But who knows, maybe I’ll be kicking myself soon with the whole SmartScreen reputation side of things.

P.S. I dug up from my archives the link to the EV Validation process for those interested.

Meanwhile, it’s a one click process to get certificates on xCode and one click to get apps notarized by Apple secure service for delivery to users. The windows world is such a pain point. After trying Sectigo, I gave up to sign Windows apps.

Thanks, everyone! It’s good to know I’m not the only one who’s faced these frustrations, but being forced to pick from a small number of expensive vendors really isn’t great. IIRC, K-Sign charged us USD985 for a three year certificate and then passed us straight over to Sectigo, who I was trying to avoid after everything I read about them on here.

@Thom_McGrath: starting a few months in advance is a very good idea. I’ve set myself a reminder six months before this certificate expires. Luckily this happened at a quiet time for us, if we had these unexpected delays in the middle of a major release cycle then we would have been in an awkward situation.

Thanks for all of that information! I will look into getting a backup token from Sectigo, but I’m not confident that their processes will make that easy. You’d think that for $985 you might be assigned to someone who at least pretends to be helpful…

It makes me very happy to pay ~£75/year for the Apple Developer programme, and then of course the excellent App Wrapper to automate our installer build and sign process!


D&B sound like a real bunch of amateurs. I concluded that before I reached your PS, but your PS only confirms my impression. This quote may explain why:

Anyone who slaps a ‘this page is best viewed with Browser X’ label on a Web page appears to be yearning for the bad old days, before the Web, when you had very little chance of reading a document written on another computer, another word processor, or another network.

– Tim Berners-Lee

Following up from this, I contacted Sectigo about ordering a backup token and was told I need to contact KSoftware because I ordered the original via them (while trying to avoid using Sectigo… :man_facepalming:)

KSoftware’s website SSL certificate seems to have expired, and hasn’t been fixed in a week. That’s… not a great sign for a certificate provider? Are they now defunct?