Both certificates put your verified company name on what you sign. They differ in how much Certum checks first, and in what that opens. OV is a great first certificate for a small developer or team. EV is the better certificate, for an organisation that wants to show more.
What OV and EV do
Both are code signing certificates issued by Certum, one of the certificate authorities Microsoft lists for EV certificates on its driver signing requirements page.
- OV, organisation validation (Standard): Certum checks your company against its public register and checks the person named on the order. You get a verified publisher name on everything you sign.
- EV, extended validation: everything in OV, plus independent confirmation that the business operates, a callback to a number in a directory Certum trusts, and a subscriber agreement signed by someone authorised to bind the company. That makes EV the better certificate: more validations, the stronger verified identity behind your publisher name, and a higher reputation with customers and procurement teams (Microsoft notes EV may matter for enterprise procurement). Microsoft requires an EV certificate on your Hardware Dev Center account to submit kernel-mode drivers, and some customers and security policies name EV.
What both give you
- The files you can sign. Both sign .exe, .dll, .msi, .msix and .appx files, PowerShell scripts and Office macros: anything Authenticode covers.
- Your name in Windows. Windows shows your verified company name for both, instead of “Unknown publisher”.
- SmartScreen. Both can help build SmartScreen reputation: a valid certificate gives SmartScreen a publisher to recognise. Reputation builds as people download and run your signed files, so sign every release with the same identity. Our SmartScreen guide explains what shortens the warning period.
- Key protection, no token. Since June 2023 every code signing key, OV or EV, must be held in certified hardware. Both of ours are generated and kept in Certum’s cloud hardware security module. Nothing is shipped, for OV or for EV.
- How you sign. SimplySign Desktop presents the certificate to Windows, so you sign with signtool and your usual installer tools from your own machine.
- Validity. Certum issues code signing certificates for at most 459 days.
Where EV goes further
Kernel-mode drivers
This is the one hard technical difference. Microsoft signs kernel-mode drivers through the Hardware Dev Center, part of the Windows Hardware Developer Program, and your account there must have at least one valid EV certificate. Once it has, Microsoft also accepts submissions signed with a standard certificate registered to the same account, though it recommends EV for those too. Without EV on the account, you cannot submit a driver at all. Your EV certificate opens the account. Microsoft then signs the driver, through attestation signing or Windows Hardware Compatibility Program certification.
Who can buy
Klarseal sells EV to registered organisations only. Registered sole traders can order Standard (OV) from us. EU and UK orders currently need a VAT number. If you don’t have one yet, contact us and a person will help. If you plan to sell your software, registering a small business is often the first step.
Validation
EV asks more of your company: the independent business check, the directory callback and a signed subscriber agreement. We do not promise an issuance date for either level. Certum validates after payment, and the pace depends mostly on how quickly you supply documents.
Price
Standard (OV) is €159 and EV €289 for one year, both net. Norwegian companies pay 1 790 kr and 3 490 kr for one year, plus 25 % MVA. Companies outside Norway pay in EUR with no Norwegian VAT. EU businesses with a VAT number that validates in VIES are invoiced under reverse charge, and the invoice says so.
Both are available for 1, 2 or 3 years, paid once, with a lower price per year on the longer terms.
Which one to start with
OV is a great first certificate if you ship user-mode software, you are a developer or a small team, you are a registered sole trader, or a verified publisher name is what you need. See Standard (OV) code signing.
EV is the right choice if you are an established organisation that wants to show more with the better certificate, you submit kernel-mode drivers now or within the certificate’s validity, or a customer or policy names EV. See EV code signing.
Decide in three questions
- Will you submit kernel-mode drivers to Microsoft while this certificate is valid? Yes: EV.
- Has a customer or a policy named EV? Yes: EV.
- Are you a registered sole trader? Yes: Standard (OV), because we sell EV to registered organisations only.
Otherwise, start with OV, or choose EV if you are an organisation and want the better certificate from the first release.
Order
Choose Standard (OV), €159 for one year or EV, €289 for one year, both net. You pay when you order. If the certificate cannot be issued, we refund the full amount. Still unsure? The code signing overview sets the two side by side, or contact us and a person answers.
Sources
Microsoft Learn, Driver code signing requirements checked 30 October 2026, and SmartScreen reputation for Windows app developers, checked 31 October 2026. CA/Browser Forum code signing baseline requirements (hardware key protection since June 2023). Certum product documentation (validation steps, cloud key storage, 459-day maximum validity).