Cheap Code Signing Certificates

WARNING: if you are getting your code signing certificate from VeriSign or Thawte, DO NOT use a Windows Vista or Win7 computer to get your certificate. If you do, you will not be able to export the private key and so you won't be able to sign code on any other computer and you won't be able to back up your certificate. If this happens to you, Thawte will give you a free reissue (Thanks Thawte!) See https://www.thawte.com/ssl-digital-certificates/technical-support/ Make sure you do not use a Vista or Win7 computer for the reissue! [Added 7/13/2008]

Code signing certificates are expensive. VeriSign charges about $495/year. We've had a VeriSign certificate since 2001, originally because ActiveX controls must be signed to easily distribute them. Today, the Windows Vista Logo Requirements require that your installer, your EXEs, and all of your DLLs be signed with a code signing certificate.

This year I tried to find a cheaper solution than VeriSign. I thought I'd share my results. 

VeriSign

VeriSign is arguably the King of Code Signing Certificates. They've established a strong brand and are widely recognized by consumers. Their certificates are universally recognized.

I have two frustrations with VeriSign. First, they use PVK files, which are aggravating to deal with, as I describe in an earlier blog entry.

Second, something breaks every other time we renew. The first time was when they started signing their code signing certs with an intermediate certificate instead of a top level cert. That caused us all sorts of problems. For a later renewal VeriSign suddenly decided that they couldn't support punctuation in the name, which meant that putting a comma before "Inc" was problematic. We had to change the company name in our build process, create a new cert from scratch instead of getting a renewal, and other problems.

When you are charging your customers that much money, you shouldn't be causing them this many problems. 

Thawte

Thawte is about half the price of VeriSign. They appear to have equivalent compatibility (all the way back to Windows 95) but they don't have the brand recognition. If I were launching a new product today, I'd get a Thawte certificate. (see July 2010 update, below)

VeriSign now owns Thawte and continues to sell Thawte certs for half the price of VeriSign certs. It makes no sense to me.

Note that Thawte uses the VeriSign timestamping URL.

GlobalSign

GlobalSign also has compatibility going back to Windows 95, but I would not use them. GlobalSign limits you to 50 timestamps per year. Since we timestamp about 12 components every time we do a release build, we go through thousands of timestamps every year. Since timestamps are critical for a commercial product, I would not consider buying a certificate from GlobalSign.

Comodo

Comodo is the preferred "cheap solution." Both John Robbins and Keith Brown have blogged about this company.

A concern with Comodo certificates is that they don't work under Win9x unless the users have installed the Root Certificate Update. Since that update is an "optional" component under Windows Update, it's rare for unsophisticated users to install it. Therefore, if your application supports Windows 9x, I recommend you skip Comodo.

Conclusion

Here's my opinion if your audience is largely English speaking:

• Internal use application - use your company's root certificate if you have one, otherwise use Comodo.
• Commercial software application - buy VeriSign if you have a premium brand, otherwise buy Thawte.
• Hobby or shareware developer - buy Comodo unless you need to support Win9x, in which case buy Thawte. 

Update 7/19/2010

• If you are using Visual Studio 2008 or later, Win9x isn't supported, so you might as well use Comodo.
• If you buy your Comodo certifiate through Tucows, the price goes down to $75/year or less!
• To join WinQual (required for Microsoft Partner status), you must have a VeriSign certificate. However, you don't have to spend $495. You can get a one year code signing certificate from VeriSign for $99! This offer is only valid for one year certificates. If you try and choose two or three year, the price goes back up to normal. At the end of that year, switch to Comodo.
• Comodo does not try calling the registered phone number. Thawte does.
• Comodo requires that the WhoIs Registrant for the company domain have the same postal address as the company paperwork (such as the DUNS listing.) If necessary, you can change your WhoIs listing until the cert is approved, then change it back. Changing the Administrative or Technical contact is not sufficient.
• This article does not apply to code signing for device drivers.