If you last bought a code signing certificate before mid-2023, the process has changed in one fundamental way: you can no longer hold the private key yourself as a file.
What changed
On 1 June 2023 the CA/Browser Forum’s baseline requirements for code signing began
requiring that private keys be generated and stored on hardware certified to
FIPS 140-2 Level 2, Common Criteria EAL 4+ or equivalent. Every publicly trusted
certificate authority had to comply. The practical consequence is that no compliant
CA will hand you an exportable .pfx.
Why the rule exists
Stolen signing keys were being used to sign malware that inherited a legitimate publisher’s reputation. A key that can be copied is a key that can be stolen. Moving keys into certified hardware makes copying infeasible; a compromise now requires access to the hardware rather than access to a file share.
Your two compliant options
A hardware token. The CA ships you a physical cryptographic token. It works, and some organisations require it for policy reasons. The costs are practical rather than technical: shipping time, customs for non-EU destinations, replacement if lost, and the awkward fact that a build server cannot use a token that is plugged into a laptop.
Cloud signing. The key is generated inside the CA’s HSM and never leaves it. You
authenticate to the signing service, which performs the signature. Certum’s
implementation is SimplySign: a desktop application presents the cloud certificate to
Windows as a virtual smart card, so signtool and every installer builder work
unchanged.
Both satisfy the requirement identically as far as trust is concerned. Cloud signing has become the default because nothing has to be shipped.
What this means for CI/CD
This is the honest caveat. Cloud signing sessions are protected by a time-based one-time password from a mobile app, which does not map cleanly to an unattended build agent. Teams solve it by keeping a signing session alive on a dedicated signing host, or by centralising signing in one service that pipelines call. Plan that design before you buy — it is the part of the migration that surprises people.
Both standard and EV certificates from Klarseal are cloud certificates, so the HSM requirement is met by construction.