Guides on code signing workflows, PKI, HSM/cloud key storage, and certificate compliance — from the CodeSignCert.com team.
What is post-quantum code signing? Post-quantum code signing means signing software, drivers and firmware with algorithms that a quantum computer cannot break, in place of RSA…
The short answer Microsoft is changing how it signs Windows itself, in three steps. The Windows Production PCA 2011 certificate expires on October 19, 2026. Stronger…
If you’ve spent any time around a build server, a release pipeline, or a security review, you’ve heard the word “artifact” thrown around constantly. Developers use…
A signed application isn’t automatically a trusted one. I’ve reviewed enough broken release pipelines to know that teams often treat code signing as a checkbox, get…
If you’ve been asked to set up EV code signing and someone on your team said “no more USB tokens,” you’re probably wondering if that’s even…
If you bought a code signing certificate before 2023, you probably remember downloading a .pfx file, dropping it on a build machine, and moving on with…
Code signing has quietly become one of the more scrutinized parts of the software release process. Every CA/Browser Forum policy change over the past few years…
Hardware tokens require physical handling and manual renewal that does not scale at a 460-day certificate cycle, while cloud-based code signing automates rotation and removes the bottleneck entirely.
Teams spend months hardening their VPCs, locking down IAM policies, and enabling GuardDuty — and then store their encryption keys in software-based key stores accessible to anyone with root access.
An authoritative guide for security leaders, architects, and DevSecOps professionals evaluating Trusted Platform Modules (TPM) and Hardware Security Modules (HSM).
support@codesigncert.com
