Help & FAQ

Validation is done by the certificate authority, and how fast it goes depends mostly on how quickly you supply documents. After you order, the pace is set by Certum’s company check and by the identity check of the person you name. We do not promise a date, because we do not control those two steps. What we control is that your application enters complete, which is what usually causes delay.

Standard proves your company published the software and is right for most publishers. EV is required for kernel-mode drivers and by some enterprise policies. If no customer or policy has asked you for EV, Standard does the same job with less validation work.

Companies registered in Brønnøysundregistrene with an organisation number, including registered sole traders (enkeltpersonforetak). A sole trader can hold a Standard (OV) certificate; extended validation needs a registered company, because EV validation is built around a legal entity rather than a person trading under their own name. Your registry record says which you are.

Klarseal sells to businesses — Norwegian companies and registered sole traders with an organisation number. As a private person you can buy the same certificate directly from Certum.

Your organisation number, and the name, work email and phone number of the person who will hold and use the certificate. The orderer does not have to be a signatory, but someone with signing authority in Brønnøysundregistrene has to authorise the order before Certum will validate it — we read the signatory list from the registry and show it to you, so nobody has to guess who is allowed to sign.

Your registered legal name, exactly as Brønnøysundregistrene holds it, suffix included. Certum validates against the registry, so a trade name, a brand or a shortened form cannot be substituted. If the registry name is not the name you want customers to see in the Windows install dialog, change it in the registry first and order afterwards.

No. Klarseal is a reseller. The certificate authority is Certum, operated by Asseco Data Systems S.A. in Poland and listed on the EU Trusted List. Certum validates your company, runs the identity check, issues the certificate and holds the private key in its hardware security module. We take the order, pre-check your company against the registry, and support you through it. The Issued by Certum page sets out who does what, line by line.

Not yet. A Klarseal MCP server is planned, so that an assistant could read an order, check expiry and prepare a renewal, but it is not available and we give no date. Today you follow an order through the status link in the emails we send. Paying, signing and identity checks would stay with a person and with Certum.

Both, in that order, and only Certum’s check counts. When you order we look your company up in the official register: Brønnøysundregistrene for a Norwegian company, the official company register of the country for other markets. We tell you straight away if something will block validation, such as a company that is not active or a name that does not match the register. We do not check the person ordering; Certum validates that person, and runs its own validation of the company, under the CA/Browser Forum rules it is audited against. Our pre-check exists so you do not pay for an application that was never going to clear.

Often none. Certum can usually verify a Norwegian company from the public registry on its own. When it cannot, it asks for the missing piece directly — commonly proof of the company address, or confirmation that the person named on the order may represent the company. Those requests come from Certum and go back to Certum. We can tell you what a request means; we never handle your documents on Certum’s behalf.

The person who will hold the certificate confirms who they are to Certum, normally in a short video session with Certum’s identity provider, using a passport or a national ID card. Certum books and runs it, not us. Have the document in hand, use a device with a working camera, and make sure the name on the document matches the name on the order exactly.

Certum. We look your company up in Brønnøysundregistrene by organisation number, but we do not verify the person ordering: Certum performs all identity validation, because a certificate authority has to establish who will hold the certificate itself and cannot delegate that to a reseller. The identity documents go to Certum and not to us; the process is built so that Klarseal does not receive or store them.

We do not promise a date, and you should be wary of anyone who does. Validation is done by the certificate authority, and how fast it goes depends mostly on how quickly you supply documents — a document request sitting in someone’s inbox, an identity session nobody has booked. Certum’s review and the identity check of the person you name decide the pace, not us. What we can promise is that your application reaches Certum complete, because incomplete applications are what makes certificates slow.

Yes. The usual reasons are a company that is not active in the registry, a name mismatch, an address Certum cannot confirm, or an identity check that is never completed. If the certificate cannot be issued you get the full amount back: we raise a credit memo against the original invoice and refund through Mollie to the payment method you used.

Tell us, and tell Certum. A change of legal name, address or organisation number makes the issued certificate wrong, and a certificate whose subject no longer matches the registry should be replaced rather than left in use. Certum does not reissue its SimplySign cloud certificates, so a new certificate is ordered for the new details, and you ask for the old one to be revoked (terms of sale, section 9). Start it before you ship anything else.

SimplySign is Certum’s cloud signing service and the desktop and mobile app that reaches it. Your private key is generated inside Certum’s hardware security module and never leaves it; the app authorises each signing operation and exposes the certificate to Windows so tools such as signtool can use it by subject name. Because the key lives in the HSM, every signature is a round trip to the service — there is no offline mode and no exportable key file.

No. The private key is generated and kept in Certum’s hardware security module, and you sign from your own machine through the SimplySign app. Nothing to buy, ship or lose.

Signing puts your verified company name in the dialog instead of "Unknown publisher". SmartScreen also weighs reputation, which both OV and EV build over time as your software is downloaded — since March 2024 EV no longer clears the warning instantly. Reputation accrues to the certificate, so it carries across releases.

Install the SimplySign desktop app and log in; your certificate then appears in the Windows certificate store. One signtool command does the rest: sign with SHA-256, point at Certum’s timestamp service, and name your company as the subject. The signing guide has the full command and shows how to verify that the signature took.

Windows executables and libraries (EXE, DLL, SYS, OCX), installers and packages (MSI, MSIX, APPX), PowerShell scripts and modules, Office VBA projects — anything Authenticode covers. Kernel-mode drivers submitted to the Windows Hardware Developer Program are the one case that needs EV rather than Standard.

Not with what we sell today. SimplySign asks the named person to authorise each signing operation from the app, which is exactly what an unattended build agent cannot do. If your release process needs automated signing, email hello@klarseal.com and tell us what your pipeline looks like. It is the request we most want to hear, and we would rather scope it properly than sell you something that will not fit.

Almost always the SimplySign app is not running or not logged in, so Windows can see the certificate but cannot reach the key behind it. Open the app, log in, run the command again. If it persists, check that the subject name in your /n argument matches your registered legal name character for character.

In practice, yes. Without a timestamp a signature stops validating the moment the certificate expires, so software you shipped last year starts warning users the day your 459 days run out. With one, the signature stays valid indefinitely, because a verifier can see the certificate was valid at the moment of signing. Certum’s timestamp service is included.

Because that is the maximum any code signing certificate may carry under the CA/Browser Forum baseline requirements every publicly trusted CA is audited against. It is not a Klarseal or a Certum limit, and nobody can sell you a five-year one. Longer commercial terms exist elsewhere, but they are pre-paid multi-year contracts with a reissue partway through, not a longer certificate.

Sixty days before expiry we email the people on the order, with the date to renew before. Sixty days is deliberate: it leaves room for a document request and an identity session without you ever losing the ability to sign a release.

Usually. Certum reuses verification documents for thirteen months, so if you are inside that window the paperwork half of the process largely disappears and the second certificate is far less work than the first. We still do not promise a date, because a renewal is a new certificate and Certum still has to issue it.

If you timestamped it, nothing — it keeps validating, because a verifier can see the certificate was valid when the signature was made. If you did not, those signatures stop validating at expiry and your users start seeing warnings on files that worked yesterday. This is the strongest argument for timestamping everything.

There is no grace period. You cannot sign new files until a new certificate is issued, and issuing takes as long as it takes. Releases you already timestamped are unaffected. If you are past expiry, order now rather than waiting — the clock that matters is Certum’s, and it only starts when the application is complete.

Archi Systems AS is a Norwegian company, so 25 % MVA is charged on sales to Norwegian customers, businesses included. Prices are shown net; the MVA line and the total appear at checkout and on the invoice.

Norwegian customers are priced and invoiced in NOK with 25 % MVA added. Customers outside Norway are priced in EUR and pay no Norwegian VAT: EU businesses pay net under the reverse-charge rules, and an EU order needs a VAT number that validates in VIES — without one we cannot accept it. Sales outside the EU and Norway carry no Norwegian VAT. The invoice is authoritative, and it states which treatment was applied.

You get the full amount back, MVA included. We issue a credit memo against the original invoice and refund through Mollie to the payment method you used.

As soon as the payment clears. The payment receipt email we send gives the invoice number and the total. The invoice is a PDF, with a JSON file carrying the same figures.

No. Payment is due in full when you order and is made through Mollie, using a method offered on Mollie's payment page.

The seller — Archi Systems AS, organisation number 916 683 332 MVA, registered in Foretaksregisteret — your company as the buyer, the order number in KS-YYYY-NNNN form, the certificate subject, and a net / MVA / total breakdown. It is a PDF, downloadable from your order page through the link in our emails.

Per certificate, and each certificate is issued to exactly one named person. Two people signing means two certificates, and credentials may not be shared — that is a condition of Certum’s subscriber agreement, not a Klarseal rule. There is no per-signature charge and no per-file metering; the price covers the whole 459-day term.