Code Signing Certificate Standards

As of June 1, 2023, industry standards require the private keys of OV code signing certificates to be stored on FIPS 140 Level 2, Common Criteria EAL 4+, or equivalent certified hardware. This change strengthens private-key protection for code signing certificates, bringing them in line with EV (Extended Validation) code signing certificates.

1. Sectigo OV and EV Code Signing Products

Sectigo offers two options:

• Sectigo Hardware Provisioning: The certificate requester can have Sectigo install the certificate on suitable hardware (such as a token) it provides.
• Using Your Own Hardware: The certificate requester generates the keys on suitable hardware in a non-exportable way, then prepares the certificate signing request (CSR) and a key attestation file. The key attestation file is generated by the HSM and contains the evidence needed to prove the private key was generated on suitable hardware.

The Sectigo Key Attestation Service supports the following hardware modules:

• Luna Network Attached HSM, Version 7.x
• YubiKey 5 FIPS Series

If the HSM is provided by the Sectigo CA, token and shipping costs are billed separately.

2. DigiCert and GoGetSSL OV and EV Code Signing Products

Similar to EV code signing, there are three hardware/HSM provisioning options for OV code signing certificates:

• DigiCert-Provided Hardware Token: use a pre-configured hardware token.
• Using Your Own Hardware Token: you must own one of the approved hardware tokens:
  • SafeNet eToken 5110 FIPS (ECC only)
  • SafeNet eToken 5110 CC (RSA 4096 and ECC)
  • SafeNet eToken 5110+ FIPS
• Installation on an HSM: hardware tokens and HSM devices must be FIPS 140 Level 2, Common Criteria EAL 4+, or equivalent.

If the hardware token is provided by the DigiCert CA, token and shipping costs are billed separately.

3. Code Signing with a Hardware Token or HSM

To use a token-based code signing certificate, you'll need access to the hardware token or HSM and the credentials to use the certificate stored on it. To sign code with a token, plug the hardware token into your computer and enter the password to sign your code with the code signing certificate on the token.

4. Certificate Reissuance

If you need to reissue a code signing certificate after June 1, 2023, the reissued certificate must be installed on a supported hardware token or HSM. If you don't have a token, you can purchase one from the CA.