Glossary

Microsoft’s signature format for Windows binaries — the thing a code signing certificate actually produces. An Authenticode signature is embedded in the file itself rather than shipped alongside it, and it carries the signer’s certificate chain and, if you asked for one, a timestamp. Windows checks it when the file is downloaded, installed or loaded, and uses it to name the publisher.

See also Code signing, signtool, Timestamp

The Norwegian national electronic identity, issued through banks and used for everything from tax returns to signing contracts. Klarseal does not use BankID at checkout: Norwegian companies are looked up in Brønnøysundregistrene, and Certum performs the identity validation of the person who will hold the certificate.

See also Brønnøysundregistrene, SimplySign

Norway’s central register of business enterprises, which holds every Norwegian company’s legal name, address, organisation number, status and signatories. It is public and authoritative, which is why certificate authorities validating a Norwegian company look there first. The legal name in the register is the name that ends up in your certificate — not your product name, not your domain.

See also OV, EV

The industry body where certificate authorities, browser vendors and operating-system vendors agree the rules that publicly trusted certificates must follow. Its baseline requirements for code signing set the maximum validity of a certificate (459 days), and since June 2023 they require the private key to be held in certified hardware. When a rule changes there, every CA has to follow — which is why no reseller can offer you a longer certificate or a software-only key.

See also HSM, Certificate authority

An organisation that verifies who you are and then issues certificates saying so, backed by a root key that operating systems and browsers already trust. Being a CA means passing recurring audits and following the CA/Browser Forum rules; it is not something you can become by reselling. Klarseal is a reseller — the certificate authority behind everything we sell is Certum, operated by Asseco Data Systems S.A.

See also Root store, EU Trusted List, CA/Browser Forum

The path from your certificate up through one or more intermediate certificates to a root certificate in the verifier’s trust store. Your certificate on its own proves nothing; it is trusted because something already trusted vouches for the chain above it. If a signature fails to verify on a machine where it should work, a missing intermediate is a common cause.

See also Root store, Certificate authority

Attaching a cryptographic signature to software so that whoever runs it can tell who published it and confirm the bytes have not changed since. It does not make software safe and it does not vouch for what the software does — it makes the publisher accountable and detectable. On Windows it is what replaces "Unknown publisher" with your company’s registered name.

See also Authenticode, SmartScreen, OV, EV

The two ways a verifier asks a certificate authority whether a certificate is still good. A CRL (certificate revocation list) is a published list of revoked serial numbers; OCSP (Online Certificate Status Protocol) is a live query about one certificate. Both exist so that a compromised certificate can be killed before it expires on its own. This is also why a revoked signature can start failing on machines that accepted it yesterday.

See also Revocation, Timestamp

A block of encoded data containing your public key and the details you want in the certificate, signed with the matching private key to prove you hold it. You send the CSR to the certificate authority; the CA validates the details and returns a certificate. With cloud signing the key pair is generated inside the CA’s hardware module, so the CSR is produced there too — and a reissue needs a fresh one rather than reusing the old.

See also Key pair, Reissue, HSM

The list each EU member state publishes of the trust service providers it supervises under eIDAS, and which the Commission aggregates. Appearing on it means a national supervisory body has assessed the provider against the regulation — it is a public, checkable statement rather than a logo somebody bought. Certum, the certificate authority behind Klarseal’s products, is on the Polish list.

See also Certificate authority

The higher of the two validation levels for code signing. The certificate authority does everything it does for OV and more: it confirms the company’s legal, operational and physical existence against independent sources and verifies the authority of the person requesting it. EV is required for kernel-mode drivers submitted to the Windows Hardware Developer Program, and some enterprise policies ask for it. Since March 2024 it no longer clears the SmartScreen warning instantly — both EV and OV build reputation over time.

See also OV, SmartScreen, Windows Hardware Developer Program

A certified tamper-resistant device that generates and holds private keys and performs signing operations inside itself, so the key never exists in ordinary memory or on disk. Since June 2023 the CA/Browser Forum has required code signing keys to live in one — which is why certificates arrive either on a USB token or, as with cloud signing, in the CA’s own HSM. In the cloud arrangement Certum holds the module and you reach it over the network; nobody, including Klarseal, can extract the key.

See also SimplySign, Key pair, CA/Browser Forum

The private key and the public key that belong together: the private key makes signatures, the public key checks them. The certificate is a signed statement binding the public key to your verified identity. Everything in code signing rests on the private key staying private, which is what the hardware requirement is for.

See also HSM, CSR, Revocation

Microsoft’s current Windows application package format, successor to MSI and AppX. An MSIX package must be signed, and the publisher name inside the package manifest has to match the subject of the signing certificate exactly or installation fails. The same code signing certificate signs MSIX, MSI, EXE and DLL — there is no separate product to buy.

See also Subject, Code signing

Norwegian value added tax, standard rate 25 %. Because Archi Systems AS is a Norwegian company, MVA is charged on sales to Norwegian customers including businesses — there is no domestic B2B exemption, so a Norwegian buyer reclaims it through their own return rather than avoiding it at purchase. Prices on this site are shown net; the MVA line and the total appear at checkout and on the invoice.

The validation level where the certificate authority confirms that your organisation exists and that you are entitled to act for it, usually against a public company register. The certificate then carries your registered legal name as the publisher. For most software publishers this is the right level: it proves the same publisher identity as EV and clears the same "Unknown publisher" dialog, with less validation work.

See also EV, Brønnøysundregistrene, Subject

Replacing a certificate within its existing term — because company details changed, because the key needs replacing, or because a multi-year contract requires it partway through. It is not a renewal: the term does not extend. A reissue needs a new certificate signing request from you, and the certificate authority may re-run part of the verification. Certum does not reissue its SimplySign cloud certificates: when the details change, a new certificate is ordered.

See also CSR, Revocation

The standing SmartScreen builds for a signing certificate as real users download and run files signed with it. It accrues to the certificate rather than to an individual file, so it carries across releases — and it resets when you start signing with a different certificate. Since March 2024 both OV and EV certificates have to build it; neither one starts at the top.

See also SmartScreen, EV

Cancelling a certificate before its expiry date, normally because the key may be compromised or the details in it are no longer true. The certificate authority publishes the revocation, and verifiers that check will stop trusting signatures made with it. Timestamped signatures created before the revocation date usually survive; untimestamped ones do not. Only the subscriber or the CA can request it — never an assistant, and never a reseller acting alone.

See also CRL and OCSP, Timestamp, Reissue

The set of root certificates an operating system or browser ships and trusts by default — Microsoft maintains one for Windows, Apple and Mozilla maintain their own. A certificate is publicly trusted because it chains up to a root already in that store, which is what makes signed software work on a machine that has never heard of you. Getting a root into a store takes years of audits, which is why there are few CAs and many resellers.

See also Certificate chain, Certificate authority

The Microsoft command-line tool, shipped with the Windows SDK, that signs files and verifies signatures. It reads certificates from the Windows certificate store, so with a cloud certificate you log in to the signing app first and then point signtool at the subject name. `signtool verify /pa /v` is how you confirm a signature took and see which timestamp authority was used.

See also Authenticode, SimplySign, Timestamp

Certum’s cloud signing service, plus the desktop and mobile app that reaches it. The private key stays in Certum’s hardware security module; the app authorises each signing operation and makes the certificate visible to Windows so ordinary tools can use it. It removes the USB token, and it also means signing needs a person to approve it — which is why unattended build-server signing is not part of this product.

See also HSM, signtool

The Windows feature that shows "Windows protected your PC" when a downloaded file looks unfamiliar. Signing replaces "Unknown publisher" with your verified company name, which is the part a certificate controls. Whether the warning appears at all also depends on reputation, which builds over time as your signed software is downloaded — since March 2024 an EV certificate does not switch it off on day one.

See also Reputation, Code signing

The field in a certificate naming who it was issued to — for code signing, your organisation’s validated legal name plus country and locality. It is what Windows displays as the publisher and what `signtool /n` matches against. Because it comes from the company register rather than from your order form, it cannot be adjusted to a trading name.

See also Brønnøysundregistrene, MSIX, OV

A countersignature from a time stamping authority recording when a signature was made. It matters because without it a signature stops validating the moment the certificate expires, while with it the signature stays valid indefinitely — a verifier can see the certificate was good at signing time. Adding one costs a command-line flag and nothing else; Certum’s timestamp service is included with the certificate.

See also signtool, Revocation

Windows features that let an administrator decide which software may run on managed machines. Both can allow software by publisher, meaning by the subject of the signing certificate, rather than by file hash. That is why signing matters for selling into companies: a signed publisher rule keeps working across your updates, while a hash rule breaks on every release.

See also Subject, Code signing

Microsoft’s programme for submitting drivers to be attested or WHQL-signed for distribution. Submissions must be signed with an EV code signing certificate, which is the main reason a publisher needs EV rather than Standard. The EV certificate signs the submission; Microsoft’s own signature is what the kernel ultimately trusts.

See also EV