Comodo EV Code Signing Certificates: Next Generation Code Signing Technology

Sign your software using Comodo EV Code Signing and take your code security to the next level

As we all know, Code Signing certificates have become an obligation these days – no matter the platform. That’s because signing code using allows the application/software developers to prove to their users that the application hasn’t been tampered with/altered by any third-party. This way, users can be sure that they’re getting the right application which has been developed by a legitimate entity. EV Code Signing certificates go the extra mile in terms of security to give an almost impeccable layer of protection to software developers.

How is an EV (Extended Validation) Code Signing certificate different from the “Normal” Code Signing?

You wouldn’t call Clark Kent a Superman if he didn’t have any of the superpowers, right? The same way, we wouldn’t attach the respected tag of ‘Extended Validation’ to any product unless it has some superpower to it. EV Code Signing has two superpowers in the form of Intensive Validation Process and Hardware-Based Two-Factor Authentication. Let’s learn about these two in a bit more details.

• Intensive Validation Process

To issue a Comodo EV Code Signing Certificate, one must undergo a stringent vetting process set in motion by the CA/Browser forum and Microsoft. Comodo conducts the validation process adhering to these rules and regulations. As a result, only trusted organizations/people can get a hold of certificates and use it to sign applications.

• Hardware-based two-factor authentication

When it comes to the world of PKI and digital certificates, the Private Key is the very central part of it. Generally, users store their Private Key on their systems, but this could sometimes become a dangerous proposition. If it’s not protected adequately, any unauthenticated user could see and use it. We don’t need to tell you how dangerous this could turn out to be, do we? To eliminate this shortcoming of regular certificates, Comodo has introduced a hardware-based two-factor authentication. In this method, the Private Key is stored in a hardware token, and one must plug this token in, in order to sign his/her code. This ensures that only the authenticated users use the Private Key and sign software.

• Instant Recognition by Microsoft SmartScreen

The developer’s community knows the pain caused by Microsoft SmartScreen filter. It’s a filter that identifies potentially hazardous websites and downloads and warns the users of the file(s) being insecure. SmartScreen might show this warning even if the file is legitimate and safe. But the question is ‘How do you make Microsoft trust you?’

If an application is signed using an EV Code Signing, Microsoft SmartScreen immediately trusts the application as a result of vetting standards set by Microsoft. Therefore, that annoying ‘security warning’ will soon be a thing of the past. It enables you to build instant reputation.

We don’t need to tell how big of a blessing this is, do we? As majority of the computers still run on Windows operating systems, your download numbers and conversion rate are surely going to rise.

Difference between EV Code Signing certificate and Code Signing certificate

Here’s a side-by-side comparison of both:

EV Code Signing	Code Signing
Extended validation (intense validation) of Publisher	Standard validation
Private Key stored on External Hardware Token	Private key stored locally
Trusted and recognized by all major browsers and operating systems, trusted by Microsoft SmartScreen filter	Trusted & recognized by all major browsers and operating systems

Do I need a Comodo EV Code Signing certificate?

There was a time when people used to ask, ‘Do I need a certificate to sign my code?’ That time is long gone, and we’re now on the cusp of evolution. In some time, EV Code Signing certificates will become a norm, and you’ll see everyone using it. So why not be a part of this transformation, and enhance your security as well as reputation?