Additionally, we took this opportunity to make our code signing provisioning process better and more user-friendly. So, keep an eye out for some new streamlined workflows on TheSSLstore.com coming very soon; these are expertly designed to make it easy for you to breeze through the new processes. In the meantime, here\u2019s what you can learn to expect with the code signing provisioning and price changes.<\/p>\n\n\n\n
Let\u2019s hash it out.<\/span><\/p>\n\n\n\n You can check out our blog post from 2022 if you want to read the full details<\/a>, but the TLDR is:<\/p>\n\n\n Starting June 1, 2023<\/strong>, code signing certificate keys must be stored on a hardware security module or token that\u2019s certified as FIPS 140 Level 2, Common Criteria EAL 4+, or equivalent. This is intended to fight against an increasingly common problem\u2014stolen code signing keys being used to sign and distribute malware.<\/p>\n\n\n\n To meet these new requirements, CAs will (in most cases) ship a compliant hardware token to the customer as part of the code signing product purchase.<\/p>\n\n\n<\/span><\/span>\n\n\n As is often the case, increasing security takes time and money\u2014and that\u2019s certainly the case here. With hardware and shipping costs added to the price of the code signing certificate, Certificate Authorities are introducing new pricing for code signing certificates.<\/p>\n\n\n\n Customers who already have a compliant token, HSM, or key vault may use it instead of purchasing a DigiCert-provided hardware token.<\/p>\n\n\n\n Sectigo is changing their prices in two phases:<\/p>\n\n\n\n Customers may choose not to purchase a token from Sectigo if they have a Thales\/SafeNet Luna or NetHSM device, or Yubico FIPS Yubikey (ECC keys only).<\/p>\n\n\n\n Other CAs are also updating their code signing prices\u2014you can expect to see new pricing from all code signing providers by about June 1 at the latest.<\/p>\n\n\n\n You might be surprised by the cost of these hardware tokens if you\u2019re comparing them to typical USB flash drives. You might be thinking: \u201cFor just a couple bucks, I can get a USB drive with gigabytes of storage\u2026way more than is needed to store a certificate and key. What\u2019s the deal?\u201d However, these aren\u2019t typical USB drives.<\/p>\n\n\n\n The CA\/B Forum standards require tokens certified as FIPS 140 Level 2, Common Criteria EAL 4+, or equivalent. These tokens include hardware and software features to run cryptographic operations while keeping the key secure\u2014they\u2019re specialized cryptographic devices similar to hardware security modules<\/a> (HSMs) or Trusted Platform Modules<\/a> (TPMs).<\/p>\n\n\n\n Code signing platforms such as DigiCert Software Trust Manager store the certificate keys in an HSM. That means you don\u2019t need to worry about hardware tokens\u2014just log in to the platform and sign your code.<\/p>\n\n\n\nQuick Recap: What are the New CA\/B Forum Changes for Code Signing?<\/h2>\n\n\n\n
![\"A](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2023\/03\/ev-certificate-token2-v2-1024x640.jpg\")
DigiCert & Sectigo Increase Prices for Code Signing Certificates<\/h2>\n\n\n\n
DigiCert<\/h3>\n\n\n\n
\n
Sectigo<\/h3>\n\n\n\n
\n
What Are These Hardware Tokens?<\/h2>\n\n\n\n
Don\u2019t Want to Mess with Tokens? Switch to a Signing Platform<\/h2>\n\n\n\n
![\"A](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2023\/03\/software-trust-manager-dashboard.png\")
<\/figure>\n<\/div>\n<\/div>\n\n\n\n