Products · Code signing
Both are issued by Certum, a certificate authority on the EU Trusted List, and both keep the private key in Certum’s hardware security module — there is no USB token to ship or lose. The difference is how much of your company gets verified, and what that unlocks.
Standard · Organisation validation
For companies that publish Windows software and want the install dialog to name them, not “Unknown publisher”.
EV · Extended validation
For companies that sign kernel-mode drivers, submit to the Windows Hardware Developer Program, or answer to a policy that names EV.
EV used to be worth paying for on reputation alone. It is not any more. Since March 2024 the instant SmartScreen treatment is gone, so both certificates start with no reputation and build it the same way — through real downloads of files you signed. Reputation attaches to the certificate, so it carries across releases either way. What EV still does, and Standard cannot, is sign kernel-mode drivers and satisfy a policy that names it.
Resellers still advertising instant warning removal for EV are describing the old behaviour.
| Property | Standard (OV) | EV |
|---|---|---|
| Validation | Organisation (OV) | Extended (EV) |
| What it proves | Your company published the file | Your company, verified from more independent sources |
| User-mode apps, installers, scripts | Signs them | Signs them |
| Kernel-mode drivers | Not accepted | Required |
| Windows Hardware Developer Program | Not accepted | Required |
| SmartScreen reputation | Builds with downloads | Builds with downloads |
| Key storage | Certum HSM, no USB token | Certum HSM, no USB token |
| What Certum checks | The registry record and the named person | The registry record, an independent check on the business, a directory callback and the named person |
| Subscriber agreement | Order confirmation | Signed by an authorised representative |
| Maximum validity | 459 days | 459 days |
Sources: Certum product documentation; CA/Browser Forum code-signing baseline requirements; Microsoft Windows Hardware Developer Program documentation.
Answered in full here. If your case is not covered, email support@klarseal.com and a person answers.
Standard, unless something specific pushes you to EV: you sign kernel-mode drivers, you submit through the Windows Hardware Developer Program, or a customer or internal policy names EV. Standard signs the same user-mode applications, installers, packages and scripts, and asks less of your company during validation.
No. Since March 2024 Microsoft no longer grants EV certificates instant reputation. Both levels start with none and build it as your signed files are downloaded, and reputation attaches to the certificate, so it carries from release to release. What signing changes immediately is the name in the dialog: your verified company instead of "Unknown publisher".
For organisation validation, Certum verifies that the company exists and matches the public registry, and checks the identity of the person named on the order. For extended validation it goes further: an independent confirmation that the business is operating, a callback on a phone number published in a directory it trusts rather than one you supply, and a subscriber agreement signed by someone authorised to bind the company.
No. Both are cloud certificates: the private key is generated inside Certum’s hardware security module and never leaves it, and you sign from your own machine through the SimplySign app. Nothing is shipped, so there is no customs delay and nothing to lose.
Ordering takes a few minutes. After that the clock belongs to Certum’s checks and to the identity check of the person you name, so we do not promise a date. What we control is that the application enters complete — we pull your registry record, verify the person ordering, and have Certum confirm the application before you pay.
Klarseal sells to businesses — Norwegian companies and registered sole traders with an organisation number. As a private person you can buy the same certificate directly from Certum.
One year, one price, either level. We check the application with Certum before you pay, and refund in full if the certificate cannot be issued.