Comodo Code Signing Certificate Review 2026
Issued today by Sectigo under the legacy Comodo brand name. Verifies software publisher identity and proves a signed file has not been altered since signing. Here is what actually changed since 2023, and where the OV tier still makes sense next to EV.
What Signing Actually Proves
A code signing certificate does two specific things: it attaches a verified publisher name to a piece of software, and it proves the file has not been modified since the moment it was signed. Neither of those things scans the code for malware or vulnerabilities.
Signing a file is an identity and integrity claim, not a security audit, and treating it as one is the most common misunderstanding buyers bring to this product. Comodo Code Signing at the OV tier verifies the requesting organization's legal registration before issuing the certificate, then embeds that verified name into every signature the certificate produces going forward.
The Hardware Key Mandate Most Pages Still Don't Mention
This is the part of the product that changed most significantly in recent years, and the part still described incorrectly on several reseller pages. The CA/Browser Forum mandated in June 2023 that private keys for all code signing certificates, OV and EV alike, must be generated and stored on a FIPS 140-2 Level 2 compliant hardware device.
What the mandate means in practice
How Business Verification Works
OV Code Signing validates the requesting organization's identity before issuance. Total time from order to first signed file typically runs 1 to 3 business days for document validation, plus token shipping time if a physical device is required rather than an existing HSM.
Business Registration Check
Sectigo verifies company registration against government or third-party business registries, often including a D-U-N-S number check. This step confirms the organization is a real, legally registered entity.
Telephone or Alternate Verification
A callback to a verified business number, or an accepted substitute such as a Legal Opinion Letter. This step works the same as OV SSL validation and can stall issuance if the business lacks a qualifying listing.
Hardware Token Provisioning
A FIPS-compliant USB token is shipped, or the certificate is installed on an existing HSM. This step only applies if you do not already have a qualifying hardware device. Teams with existing HSM infrastructure skip physical shipping entirely.
Certificate Specifications
What You Can Sign
A single Comodo Code Signing certificate covers a wide range of file types rather than being scoped to one platform. Kernel-mode Windows drivers are the only format requiring the EV tier specifically, since Microsoft's Hardware Developer Center Dashboard only accepts EV Code Signing certificates for that submission path.
What It Actually Costs
Pricing for the OV tier varies more by reseller markup than by any difference in the underlying Sectigo certificate, since validation depth and hardware key requirements are now standardized across the market at this tier. The market-wide range for OV Code Signing runs from roughly $65 to over $219 per year.
Key Changes for 2026
Code signing certificates now follow their own separate timeline from SSL/TLS certificates, and it moved faster. Effective February 15, 2026, the CA/Browser Forum capped maximum validity for all newly issued or reissued public code signing certificates at one year.
Maximum Validity Capped at 459 Days
A multi-year subscription still bills across multiple years and locks in pricing, but the certificate itself gets reissued annually onto the same hardware token or HSM throughout that term. Reissuance is less disruptive than it sounds for most workflows, since the private key stays on the existing hardware device and the reissue process is typically faster than the original validation.
Annual Reissuance onto Existing Hardware
Email reminders generally arrive 30 days before each reissuance comes due, and signing continues uninterrupted as long as the reissue happens before the current certificate expires. Teams with automated renewal workflows can largely absorb this change without disruption. Teams running manual renewal should update their reminder schedule from multi-year to annual.
Where It Wins and Loses
Where It Wins
- Verified publisher identity replaces generic Unknown Publisher warnings across Windows and most third-party download platforms
- Free timestamping keeps signatures valid indefinitely, even after the certificate itself expires
- Covers a wide range of file types and platforms under one certificate
- Unlimited signing volume for the life of the certificate
- Lower price and lighter validation burden than EV, without needing kernel driver support
Where It Loses
- Mandatory hardware key storage adds a shipping delay and a physical dependency
- USB token signing requires the token physically connected to the build machine, complicating remote or CI/CD workflows without an HSM
- Cannot sign kernel-mode Windows drivers; that submission path requires EV specifically
- Needs reissuing annually under the 2026 validity cap
- Does not scan code for malware or vulnerabilities despite sometimes being marketed as a security measure
OV Code Signing vs. EV Code Signing
Since the 2023 hardware key mandate closed the biggest technical gap between these tiers, the real differences left are validation depth, kernel driver eligibility, and how quickly each builds SmartScreen trust.
OV Code Signing — this page
EV Code Signing
Ideal Use Cases
Independent Developers and Small Software Companies
OV delivers verified publisher identity at a lower price and lighter validation burden than EV, without needing kernel driver support.
Desktop Application Publishers
Software distributed outside app stores benefits directly from the verified publisher name replacing browser and OS warnings on download.
Teams Already Running an HSM
Businesses with existing HSM infrastructure absorb the hardware key mandate with minimal workflow disruption compared to managing a physical USB token.
Windows Kernel Driver Developers
Kernel-mode driver signing requires EV Code Signing specifically. Only EV certificates gain Hardware Developer Center Dashboard access for that submission path.
Fully Remote CI/CD Pipelines Without HSM
A physical USB token cannot sign remotely. Teams without HSM infrastructure need to plan around that constraint or set up HSM access before purchasing.
Businesses Expecting Instant SmartScreen Trust
Neither tier bypasses SmartScreen warnings instantly since March 2024. Buyers expecting an immediate fix for download warnings should adjust that expectation before purchasing either tier.
Frequently Asked Questions
Ready to Compare Code Signing Certificates?
Comodo Code Signing delivers verified publisher identity and broad platform coverage at the OV tier, with the same hardware key requirement EV has always carried. Compare it against the EV tier and other providers to find the right fit for your signing workflow.
