# Which Windows EV code signing?

**URL:** <https://forum.juce.com/t/which-windows-ev-code-signing/48551>\
**Category:** Windows\
**Created:** [November 1, 2021, 9:30pm UTC](https://forum.juce.com/t/which-windows-ev-code-signing/48551 "2021-11-01T21:30:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![alatar](https://avatars.discourse-cdn.com/v4/letter/a/34f0e0/32.png) [@alatar](https://forum.juce.com/u/alatar)\
**Post date:** [November 1, 2021, 9:30pm UTC](https://forum.juce.com/t/which-windows-ev-code-signing/48551/1 "2021-11-01T21:30:34Z")

</div>

We are currently looking into EV code signing on Windows. Because several customers said that Windows flags our installers as unsafe.

I saw that there are quite a few companies which offer EV certificates. For example:  
DigiCert,  
Sectigo  
GlobalSign,  
Entrust,  
Certum,  
SSL  
(And probably others)

I am a bit confused at the moment, which of those I should choose?  
Which certification company are you using for your EV certificates?

---

<div class="post-metadata">

**Author:** ![benediktadams](https://avatars.discourse-cdn.com/v4/letter/b/6a8cbe/32.png) [@benediktadams](https://forum.juce.com/u/benediktadams)\
**Post date:** [November 9, 2021, 11:01am UTC](https://forum.juce.com/t/which-windows-ev-code-signing/48551/2 "2021-11-09T11:01:18Z")

</div>

We’re using [SSL.com](http://SSL.com) .

They deliver their certificate on a YubiKey dongle though, which might be problematic for automated build chains. There are workarounds to facilitate automated build chains with YubiKey, but the regular old signtool will want a PIN entry on every signature with this. There is a 3rd party option (ScSignTool), which can handle the PIN for regular signatures, but I have yet to find a way for pace wraptool, to work with the pin… Right now I have all signatures automated with the exception of aax. So on every installer build I have to enter the pin once for aax…

Unfortunately it seems these days providers only distribute the EV certificates on dongles and only give you cert files for OV certificates, which have the advantage of working easily with signtool and pace wrapper, but don’t satisfy Windows Smart Screen off the bat (it will need a few startups on different machines until Microsoft knows you and deems you safe). I haven’t yet found a way to just disable the PIN on the YubiKey either…

Also check out this thread a few entries further down 🙂

> [@Who is bothering with EV code signing on Windows?](https://forum.juce.com/t/who-is-bothering-with-ev-code-signing-on-windows/43605/16):
>
> Yup, no choice but have them hold your business hostage until they send you an EV cert on a usb key… Does anyone here have experience with cloud EV certs, and could recommend a provider? The usb key makes it a PITA for setting up build pipelines since they need to be built locally, but worse, they popup a window with a native message box for the password so I don’t even know how to script this properly. We’ve managed a full pipeline with github actions on mac but PC I’m still running things ma…