{"id":485,"date":"2022-09-28T10:15:51","date_gmt":"2022-09-28T10:15:51","guid":{"rendered":"https:\/\/signmycode.com\/blog\/?p=485"},"modified":"2026-09-28T10:24:10","modified_gmt":"2026-09-28T10:24:10","slug":"ev-code-signing-without-hardware-token-is-it-possible","status":"publish","type":"post","link":"https:\/\/signmycode.com\/blog\/ev-code-signing-without-hardware-token-is-it-possible\/","title":{"rendered":"EV Code Signing without Hardware Token – Possible?"},"content":{"rendered":"\n

Organizations utilize the EV Code Signing Certificate to secure software to the highest standard. However, to configure it for digital signing and timestamping, a hardware token is issued by the CA.<\/p>\n\n\n\n

However, there can be chances that someone lost that Token or forgot its passcode, or anything unexpected happens. No company wants to go through such a situation. And to prevent it, they started to find the Extended Validation Code Signing without a hardware token.<\/p>\n\n\n\n

\n

Note:<\/strong> Since June 1, 2023, All Code Signing Certificate including OV and IV private keys must be protected using a compliant hardware-based solution, such as an HSM, certified USB token, cloud HSM, or approved signing service.<\/strong><\/p>\n<\/blockquote>\n\n\n\n

So, let’s get started to discover whether signing without a token is possible or not.<\/p>\n\n\n\n

What is EV Code Signing and Hardware Token?<\/h2>\n\n\n\n

When any organization needs to provide the highest level of security assurance, selecting EV Code Signing Certificate<\/a> is the first preference. As the name suggests, Extended Validation Code Signing utilizes the advanced hashing mechanism, making the Code secure from malicious actors.<\/p>\n\n\n\n

In addition, the applicant must undergo a strict verification procedure to buy an EV Code Signing Certificate. Therefore, only legitimate businesses get the EV certificate.<\/p>\n\n\n\n

Recommended: <\/strong>Requirements to Obtain an OV or EV Code Signing Certificate<\/a><\/p>\n\n\n\n

Furthermore, the only Code Signing Certificate assures zero warnings and alerts from the Defender SmartScreen<\/a> mechanism. When any end-user installs the software with such a certificate, the operating system treats it as legitimate. And its installation procedure gets completed impeccably.<\/p>\n\n\n\n

Another reason for selecting it is the Hardware Token.<\/p>\n\n\n\n

Whenever any Certificate Authority issues an EV Code Signing Certificate, its private key is delivered in an external USB drive. It is an additional security layer, as only a limited number of people can access it. Moreover, it gets stored offline, preventing attackers from gaining access to it.<\/p>\n\n\n\n

A hardware token or the external USB is a crucial component, as an organization doesn\u2019t sign the software without it. Let’s walk through it, working to understand it better.<\/p>\n\n\n\n

How does EV Code Signing Certificate Works?<\/h2>\n\n\n\n
\"How<\/figure>\n\n\n\n

EV Code Signing Certificate utilizes the hashing and encryption mechanisms to secure the source code<\/a>. Every organization undergoes the following steps to maintain code integrity.<\/p>\n\n\n\n

Step 1: <\/h3>\n\n\n\n

Source code is selected, and the enterprise performs hashing on it. It converts the overall Code into an unreadable format, preventing attackers from making unauthorized alterations.<\/p>\n\n\n\n

Step 2: <\/h3>\n\n\n\n

The company configures the external hardware token into its system and uses it to sign the software. Both automatic and manual approaches use SignTool to complete the signing procedure.<\/p>\n\n\n\n

In addition, a timestamp<\/a> also gets added to the software, optimizing its authenticity.<\/p>\n\n\n\n

Step 3: <\/h3>\n\n\n\n

Now, the publisher has the hashed and encrypted executable file, which will be uploaded to the server for end-users.<\/p>\n\n\n\n

Step 4: <\/h3>\n\n\n\n

When any end-user downloads the software, their browser will check its authenticity. After successful download, the operating system will cross-verify the hash value and cryptographic keys.<\/p>\n\n\n\n

After passing all the checks, the software will be installed successfully. As EV Code Signing Certificate provides the highest level of business legitimacy, the system will not show any warning message to the user.<\/p>\n\n\n\n

\"Cheap<\/a><\/figure>\n\n\n\n

Is it Possible to Sign the Code by not using External Hardware Token?<\/h2>\n\n\n\n

After going through the working of the EV Code Signing Certificate and its overview, it is clear that a hardware token is a necessary component. Every Certificate Authority provides a hardware token to its EV applicant.<\/p>\n\n\n\n

Recommended Read: <\/strong><\/em>What is HSM? Role of HSM in Digital Signing<\/a><\/p>\n\n\n\n

In addition, such tokens are one of the primary reasons behind the EV certificate’s popularity.<\/p>\n\n\n\n

To strengthen security, organizations prefer the Comodo EV Code Signing Certificate<\/a>. Additionally, it is more expensive than IV and OV certificates. Hence, to fulfill the promise of top-level security and to provide value for money, CAs provide an external USB.<\/p>\n\n\n\n

Therefore, it is impossible to digitally sign the software without a hardware token while using the Extended Validation Code Signing Certificate.<\/p>\n\n\n\n

It would help if you safeguarded the external USB behind appropriate physical security to protect the private key associated with your digital signature.<\/p>\n\n\n\n

Why Hardware Token with Extended Validation Code Signing?<\/h2>\n\n\n\n

Extended Validation certificates are issued to companies that prove their business legitimacy. Mainly, large enterprises select the EV software signing certificate to provide a seamless experience. And also for bypassing the Defender SmartScreen alert.<\/p>\n\n\n\n

Additionally, companies Purchase EV Code Signing Certificates<\/a> to leverage cutting-edge security benefits. Hence, the advantage of an external USB or hardware token.

Moreover, Certificate Authorities provide the Token for the following reasons:<\/strong><\/p>\n\n\n\n