EV Code Signing vs. OV Code Signing: Key Differences
-
OV and EV code signing certificates sign software the same way. The difference is how thoroughly the certificate authority checks the publisher before issuing the certificate. Here's how the two compare and which one you need.
-
-
*
What OV and EV Have in Common
Both certificate types do the same job: they link your software to a verified publisher and let users' systems detect whether the code was changed after signing. The signing process is identical. You use the same signing tools, sign the same file types, and can add a timestamp so signatures stay valid after the certificate expires.
The rules for key storage and validity are the same as well:
- Hardware key storage. Since June 2023, the private key for both OV and EV must be generated and stored in secure hardware, such as a USB token, an HSM, or a cloud HSM. See Code Signing 2023 Industry Changes.
- Validity period. Since March 2026, both OV and EV code signing certificates can be issued for a maximum of 460 days. See Code Signing 2026 Industry Changes.
For a general overview of how code signing works, see Code Signing Certificates .
-
*
OV vs. EV at a Glance
OV Code Signing EV Code Signing Who can get it Organizations and individual developers Registered legal entities only Validation Verifies the organization (or individual) and the person requesting the certificate Extended checks of the organization and of everyone who requests and approves the certificate Private key storage Hardware token, HSM, or cloud HSM Hardware token, HSM, or cloud HSM Maximum validity 460 days 460 days SmartScreen reputation Built gradually over time Built gradually over time Microsoft Hardware Developer Program registration Not accepted Accepted (needed for kernel-mode drivers) Typical use Applications, installers, scripts, and updates Windows kernel-mode drivers, or when a partner, marketplace, or policy requires EV -
*
How Validation Differs
OV validation confirms that the organization exists and that the person requesting the certificate is allowed to act on its behalf. Individual developers can also get an OV certificate, issued in their full legal name instead of a company name.
EV validation goes further. The certificate authority checks the organization's legal and operational existence and confirms the authority of everyone involved in requesting and approving the certificate. EV is available to registered legal entities only, and because more documents and confirmations are needed, issuance usually takes longer.
For the full list of checks, see Code Signing Certificate Validation Requirements.
-
*
SmartScreen Reputation
EV certificates used to give software an instant positive reputation in Microsoft Defender SmartScreen. That's no longer the case. Today, both OV- and EV-signed software builds reputation gradually as more users download and run it, which usually takes a few weeks.
Tip: Sign every release with the same certificate and publisher name. Changing the signing identity between releases can reset the reputation your software has already built.
-
*
Signing Windows Drivers
Kernel-mode drivers for Windows are the main case where EV is mandatory. An EV certificate is required to register for the Microsoft Hardware Developer Program. You submit your driver packages through this program, and Microsoft signs them.
User-mode drivers don't need Microsoft's signature and can be signed with an OV certificate.
Important: An OV certificate can't be used to register for the Microsoft Hardware Developer Program. If you develop kernel-mode drivers for Windows, choose EV.
-
*
Which One Should You Choose?
Choose OV if you sign applications, installers, scripts, or updates and no one requires EV from you. OV is also the only option for individual developers.
Choose EV if you develop kernel-mode drivers for Windows, or if a customer, marketplace, or your own security policy specifically requires extended validation.
-
