Compare Items
Please, add items to this compare group or choose not empty group
Comodo Code Signing Certificate Review 2026 | CompareCheapSSL

Comodo Code Signing Certificate Review 2026

Issued today by Sectigo under the legacy Comodo brand name. Verifies software publisher identity and proves a signed file has not been altered since signing. Here is what actually changed since 2023, and where the OV tier still makes sense next to EV.

Attaches verified publisher identity to every signed file, replacing Unknown Publisher warnings
Free timestamping keeps signatures valid indefinitely even after the certificate expires
Covers unlimited signing of software, scripts, and applications for the life of the certificate
!Private keys must now live on a FIPS 140-2 hardware token or HSM for both OV and EV tiers
Organization Validation (OV) From $219.99/yr 459-day max validity
CompareCheapSSL
Our Verdict
4.0
out of 5 ★★★★☆
ValidationOV (Business Verification)
Issuance1 to 3 days + shipping
From$219.99/yr
Key storageHardware token or HSM
Max validity459 days (1 year)
TimestampingIncluded free

What Signing Actually Proves

A code signing certificate does two specific things: it attaches a verified publisher name to a piece of software, and it proves the file has not been modified since the moment it was signed. Neither of those things scans the code for malware or vulnerabilities.

Signing a file is an identity and integrity claim, not a security audit, and treating it as one is the most common misunderstanding buyers bring to this product. Comodo Code Signing at the OV tier verifies the requesting organization's legal registration before issuing the certificate, then embeds that verified name into every signature the certificate produces going forward.

ℹ️
What the signed publisher name actually does: Windows, browsers, and third-party download platforms read the embedded identity and replace a generic "Unknown Publisher" warning with the verified organization name. This is the primary visible change a signed application produces for end users.
🔍
Not a malware scanner: Code signing does not detect or remove malicious code. A signed piece of malware is still malware, and signing should not be described or purchased as a general security measure.

The Hardware Key Mandate Most Pages Still Don't Mention

This is the part of the product that changed most significantly in recent years, and the part still described incorrectly on several reseller pages. The CA/Browser Forum mandated in June 2023 that private keys for all code signing certificates, OV and EV alike, must be generated and stored on a FIPS 140-2 Level 2 compliant hardware device.

What the mandate means in practice

Key locationUSB hardware token or HSM only. No server-stored keys, no software-based keys, regardless of tier.
ExportabilityNon-exportable by requirement. The private key cannot be copied out of the hardware device it was generated on.
Remote signingA USB token must be physically connected to the signing machine. Remote signing requires an HSM, not a USB token.
CI/CD pipelinesOnly supported via HSM integration. A USB token cannot be accessed over Remote Desktop or similar connections.
Old reseller copyAny page describing OV Code Signing as software-key-based reflects the pre-June 2023 standard and is no longer accurate.
💡
This removed the biggest OV vs EV technical difference. Before June 2023, EV required hardware keys and OV did not. Now both tiers require the same FIPS hardware storage, which is why the remaining differences between OV and EV are validation depth, kernel driver eligibility, and SmartScreen reputation accumulation speed.

How Business Verification Works

OV Code Signing validates the requesting organization's identity before issuance. Total time from order to first signed file typically runs 1 to 3 business days for document validation, plus token shipping time if a physical device is required rather than an existing HSM.

1
1 to 2 business days

Business Registration Check

Sectigo verifies company registration against government or third-party business registries, often including a D-U-N-S number check. This step confirms the organization is a real, legally registered entity.

2
Adds 1 to 2 business days if flagged

Telephone or Alternate Verification

A callback to a verified business number, or an accepted substitute such as a Legal Opinion Letter. This step works the same as OV SSL validation and can stall issuance if the business lacks a qualifying listing.

3
2 to 5 business days (physical shipping)

Hardware Token Provisioning

A FIPS-compliant USB token is shipped, or the certificate is installed on an existing HSM. This step only applies if you do not already have a qualifying hardware device. Teams with existing HSM infrastructure skip physical shipping entirely.

Certificate Specifications

Signature Algorithm
SHA-2
Validation Type
Organization Validation (OV)
Key Storage
FIPS 140-2 Level 2 (mandatory)
Key Exportability
Non-exportable
Timestamping
Included, free
Signing Volume
Unlimited files
Max Validity (2026)
459 days (1 year)
Multi-Year Plans
Available, annual reissuance

What You Can Sign

A single Comodo Code Signing certificate covers a wide range of file types rather than being scoped to one platform. Kernel-mode Windows drivers are the only format requiring the EV tier specifically, since Microsoft's Hardware Developer Center Dashboard only accepts EV Code Signing certificates for that submission path.

🪟Microsoft Authenticode (.exe, .dll, .msi)
🪟Authenticode 32-bit and 64-bit builds
Java archives (.jar)
🎞️Adobe AIR applications
📄VBA and Office macros
⚙️PowerShell scripts
🦊Mozilla extensions
🍎Apple application packages
⚠️
Kernel-mode Windows drivers require EV: Microsoft's Hardware Developer Center Dashboard only accepts EV Code Signing certificates for kernel-mode driver submission. If kernel driver signing is your use case, OV Code Signing will not work for that specific submission path.

What It Actually Costs

Pricing for the OV tier varies more by reseller markup than by any difference in the underlying Sectigo certificate, since validation depth and hardware key requirements are now standardized across the market at this tier. The market-wide range for OV Code Signing runs from roughly $65 to over $219 per year.

MARKET LOW
Market range (OV)
~$65/yr
Varies by CA and reseller markup. Underlying Sectigo certificate is identical.
SignMyCode
$219.99/yr
Standard OV listing, Sectigo root
💡
Price reflects markup, not certificate quality: A $65/yr OV Code Signing certificate and a $219.99/yr one issued by the same CA are the same product. The price difference reflects the reseller's margin and bundled services, not validation depth or signing capability. Compare total cost of ownership including hardware token shipping fees before deciding.

Key Changes for 2026

Code signing certificates now follow their own separate timeline from SSL/TLS certificates, and it moved faster. Effective February 15, 2026, the CA/Browser Forum capped maximum validity for all newly issued or reissued public code signing certificates at one year.

1

Maximum Validity Capped at 459 Days

A multi-year subscription still bills across multiple years and locks in pricing, but the certificate itself gets reissued annually onto the same hardware token or HSM throughout that term. Reissuance is less disruptive than it sounds for most workflows, since the private key stays on the existing hardware device and the reissue process is typically faster than the original validation.

2

Annual Reissuance onto Existing Hardware

Email reminders generally arrive 30 days before each reissuance comes due, and signing continues uninterrupted as long as the reissue happens before the current certificate expires. Teams with automated renewal workflows can largely absorb this change without disruption. Teams running manual renewal should update their reminder schedule from multi-year to annual.

ℹ️
SmartScreen also changed in 2024: Microsoft removed instant SmartScreen bypass for EV certificates in March 2024. Both OV and EV now build download reputation gradually based on signing volume and user download behavior, though EV still accumulates that reputation faster.

Where It Wins and Loses

Where It Wins

  • Verified publisher identity replaces generic Unknown Publisher warnings across Windows and most third-party download platforms
  • Free timestamping keeps signatures valid indefinitely, even after the certificate itself expires
  • Covers a wide range of file types and platforms under one certificate
  • Unlimited signing volume for the life of the certificate
  • Lower price and lighter validation burden than EV, without needing kernel driver support

Where It Loses

  • Mandatory hardware key storage adds a shipping delay and a physical dependency
  • USB token signing requires the token physically connected to the build machine, complicating remote or CI/CD workflows without an HSM
  • Cannot sign kernel-mode Windows drivers; that submission path requires EV specifically
  • Needs reissuing annually under the 2026 validity cap
  • Does not scan code for malware or vulnerabilities despite sometimes being marketed as a security measure

OV Code Signing vs. EV Code Signing

Since the 2023 hardware key mandate closed the biggest technical gap between these tiers, the real differences left are validation depth, kernel driver eligibility, and how quickly each builds SmartScreen trust.

OV Code Signing — this page

Validation depthBusiness registration check
Kernel driver signingNot supported
SmartScreen trustBuilds gradually over time
Typical priceFrom ~$65 to $220/yr
Hardware keyFIPS 140-2 required

EV Code Signing

Validation depthRegistration, address, requestor auth
Kernel driver signingRequired for Win HDD
SmartScreen trustBuilds faster than OV
Typical price$279.99 to $325/yr
Hardware keyFIPS 140-2 required
📋
Correct a common assumption: EV Code Signing no longer instantly bypasses Microsoft SmartScreen warnings, a change Microsoft made in March 2024. Both tiers now build download reputation over time based on signed file volume and user behavior. EV still accumulates that reputation faster and remains the only tier accepted for kernel-mode driver submission.

Ideal Use Cases

Good fit

Independent Developers and Small Software Companies

OV delivers verified publisher identity at a lower price and lighter validation burden than EV, without needing kernel driver support.

Good fit

Desktop Application Publishers

Software distributed outside app stores benefits directly from the verified publisher name replacing browser and OS warnings on download.

Good fit

Teams Already Running an HSM

Businesses with existing HSM infrastructure absorb the hardware key mandate with minimal workflow disruption compared to managing a physical USB token.

Consider alternatives

Windows Kernel Driver Developers

Kernel-mode driver signing requires EV Code Signing specifically. Only EV certificates gain Hardware Developer Center Dashboard access for that submission path.

Consider alternatives

Fully Remote CI/CD Pipelines Without HSM

A physical USB token cannot sign remotely. Teams without HSM infrastructure need to plan around that constraint or set up HSM access before purchasing.

Consider alternatives

Businesses Expecting Instant SmartScreen Trust

Neither tier bypasses SmartScreen warnings instantly since March 2024. Buyers expecting an immediate fix for download warnings should adjust that expectation before purchasing either tier.

Frequently Asked Questions

No. Since June 2023, the CA/Browser Forum requires private keys for both OV and EV code signing certificates to live on a FIPS 140-2 Level 2 compliant hardware token or HSM, and the key is non-exportable. Any information describing OV as software-key-based reflects the pre-2023 standard and is no longer accurate.
Yes, but only with an HSM installation. A USB hardware token must be physically connected to the machine performing the signing and cannot be accessed over Remote Desktop or similar remote connections. Teams running CI/CD pipelines need HSM infrastructure, not a USB token, to support automated remote signing.
No. Code signing verifies publisher identity and confirms file integrity since the moment of signing. It does not scan for vulnerabilities or malicious code and should not be treated as a substitute for a security audit or antivirus scanning.
No. Microsoft changed this in March 2024. Both OV and EV certificates now build SmartScreen reputation gradually based on signing volume and user download behavior. EV still builds that reputation faster and remains the only tier accepted for kernel-mode driver submission, but neither tier bypasses warnings immediately on first use.
If the software was signed with a timestamp, which is standard practice and included at no extra cost, the signature remains valid indefinitely regardless of certificate expiration. Unsigned or non-timestamped files will trigger warnings once the certificate expires. Always use timestamping when signing.
A maximum of one year, expressed as 459 days, per issuance under the CA/Browser Forum cap effective February 15, 2026. Multi-year subscriptions still bill across multiple years but require annual reissuance onto the same hardware device. The private key stays on the existing hardware throughout, so reissuance is typically faster than the original validation and provisioning.

Ready to Compare Code Signing Certificates?

Comodo Code Signing delivers verified publisher identity and broad platform coverage at the OV tier, with the same hardware key requirement EV has always carried. Compare it against the EV tier and other providers to find the right fit for your signing workflow.