You can no longer download a new publicly trusted code signing certificate together with its private key as a single file. Since 1 June 2023, industry rules require the private key for these certificates to be created and kept on certified hardware, such as a USB token or a hardware security module (HSM). So instead of a browser download, you receive a pre-loaded token from the certificate authority (CA), install the certificate on your own HSM, or use a cloud signing service.
Why the process changed
Code signing certificates prove who published a piece of software and that it has not been changed since it was signed. If a private key is stolen, criminals can sign malware in your name. To reduce that risk, the CA/Browser Forum’s requirements for code signing now say that private keys for publicly trusted code signing certificates, both OV and EV, must be generated and stored on hardware that meets set security standards (FIPS 140-2 Level 2 or Common Criteria EAL 4+, or equivalent).
Keys on this hardware cannot be exported. That is the point: the key never exists as a file that could be copied.
The old method, and why guides still mention it
Before the change, many CAs let you generate the key in your web browser when you ordered. After validation, the CA emailed a collection link. You had to open it in the same browser on the same computer, because that was where the private key was stored, and then export the certificate and key to a PFX (.p12) file. Older guides often recommended Firefox for this.
That method does not apply to new certificates. If you are following an old guide and the download fails, this is usually why.
How you receive a code signing certificate now
Option 1: a USB token shipped by the CA
- Complete the order and the CA’s validation of your organisation (or identity, for individual certificates).
- The CA generates the key on a hardware token, installs the certificate on it, and ships the token to you.
- Install the token’s driver software on the computer you sign from.
- Activate the token with the password or PIN the CA provides, and change it if instructed.
- Plug in the token whenever you sign.
Shipping takes time, so allow for delivery when you plan a release.
Option 2: your own token or HSM
- Generate the key pair and a certificate signing request (CSR) on your own compliant token or HSM, including a cloud HSM.
- Provide the CA with proof (an attestation) that the key was created on compliant hardware.
- After validation, the CA issues the certificate. You download only the certificate file, such as a .cer or .crt, and import it into the HSM next to the key.
Option 3: cloud signing
Some CAs offer a signing service where the key stays in the CA’s HSM. You sign through their tool or API, often from a build server. Nothing is downloaded or shipped.
Why you might not be able to download or use your certificate
- Validation is not finished. The CA will not issue the certificate until it has verified your organisation. Check your email, including spam, for requests.
- You expect a file with the private key. For new certificates there is none. Look for a shipped token or HSM instructions.
- The token driver is missing. Signing tools cannot see the certificate until the driver is installed.
- The token is locked. Too many wrong PIN entries can lock it. Contact the CA.
- The collection link is old. Links can expire or be single-use. Ask the issuer for a new one.
- The intermediate certificate is missing. Install the CA’s intermediate certificate so the chain validates.
Signing your software
On Windows, Microsoft’s SignTool is the usual command-line tool. Always add a timestamp from your CA’s timestamp server. A timestamp records when the file was signed, so the signature stays valid after the certificate itself expires. Afterwards, verify the signature with SignTool’s verify command, or check the Digital Signatures tab in the file’s properties.
Keep the key safe
- Store the token securely when not in use, and do not share its PIN.
- Limit who can sign. Many teams sign only from a dedicated build machine.
- Renew well before expiry, allowing time for validation and, if needed, for a new token to arrive.
- Report a lost or stolen token to the CA straight away so the certificate can be revoked.
Frequently asked questions
Can I still get a PFX file for code signing?
Not for new publicly trusted code signing certificates. The private key must stay on certified hardware and cannot be exported.
Is a code signing certificate the same as an SSL certificate?
No. An SSL/TLS certificate secures connections to a website. A code signing certificate signs software, scripts and drivers. For websites, see SSL certificates.
Can I sign on more than one computer?
With a USB token, you can move it between computers that have the driver installed. With an HSM or cloud signing, any authorised system can sign.
What happens to signed files when my certificate expires?
Files signed with a timestamp stay valid. Files signed without one may show as untrusted once the certificate expires.
Next step
If you need a certificate for your website rather than your software, compare options on the Tremhost SSL page. For help with a certificate order placed through Tremhost, open a ticket through the Help Centre.
