Code Signing by Platform: Windows, Java, Office Macros, Drivers and macOS

A code signing certificate from a public certificate authority (CA) signs Windows applications, Java JAR files and Office VBA macros – usually with one and the same certificate. If you need a code signing certificate for Java, the OV or EV certificate you use on Windows normally works too. Two platforms are different: macOS apps need an Apple Developer ID, and Windows kernel drivers need Microsoft’s own signature.

Use this matrix to avoid buying the wrong product. Status as of October 2026.

Platform	Certificate you need	Signing tool	Sold by BUY-SSL?
Windows apps (.exe, .dll, .msi)	OV or EV code signing certificate from a public CA	SignTool	Yes
Java (.jar)	Same CA code signing certificate	jarsigner	Yes
Office VBA macros	Same CA code signing certificate	Visual Basic Editor	Yes
Windows kernel drivers	EV certificate to register, then Microsoft signs the driver	Partner Center (Hardware Dev Center)	EV certificate: yes; Microsoft signature: no
macOS apps outside the App Store	Apple Developer ID certificate	Xcode, codesign, notarytool	No – issued by Apple

Can one code signing certificate cover Windows and Java?

Yes, for many CA-issued certificates. DigiCert and Sectigo both list Windows Authenticode, Java and Office VBA as supported formats for their code signing certificates. Platform support can differ between products, so check the details on our code signing certificates page before you buy.

The practical limit is the private key. Since 1 June 2023, code signing keys must be generated and stored on certified hardware (FIPS 140-2 Level 2 or higher), such as a USB token, an HSM or a cloud signing service. Each signing tool must be able to reach that key. The options are covered in code signing key storage requirements.

A code signing certificate cannot secure a website, and an SSL certificate cannot sign code. If that distinction is new to you, read code signing vs SSL first.

Windows applications

Windows uses Authenticode signatures, applied with Microsoft’s SignTool and a timestamp. For the full walkthrough, including SmartScreen, see how to sign Windows applications.

Code signing certificate for Java: signing JAR files

Java uses the same CA code signing certificate as Windows. You sign JAR files with jarsigner, the signing tool that ships with the JDK. jarsigner adds a signature file and the certificate chain to the JAR’s META-INF folder.

A typical command with a hardware token looks like this. Replace the timestamp URL with the one your CA publishes:

jarsigner -keystore NONE -storetype PKCS11 \
  -tsa http://timestamp.example-ca.com \
  myapp.jar "your-key-alias"

Always timestamp. Without a timestamp, the signature is treated as invalid once your certificate expires. With one, Java accepts it as valid at the time of signing.

How do I sign Office VBA macros?

You sign a VBA project from the Visual Basic Editor, using a code signing certificate installed in your Windows certificate store. Your CA code signing certificate works here as long as Windows can see it – with a token, that means the token’s driver is installed.

1. Open the file that contains the macro project.
2. On the Developer tab, select Visual Basic. Enable the tab under File > Options > Customize Ribbon if it is hidden.
3. In the Visual Basic Editor, open Tools > Digital Signature.
4. Click Choose, select your code signing certificate and confirm with OK.
5. Save the file. Re-sign after every change to the code.

Tip: Office also offers SelfCert, a tool for self-signed certificates. These are trusted only on the machine where you created them, so use them for testing, not for macros you share.

Do you need a code signing certificate for macOS apps?

Not from a public CA. To distribute Mac apps outside the App Store, you need an Apple Developer ID certificate, which Apple issues through the Apple Developer Program. Gatekeeper, the macOS feature that checks downloaded software, looks for this certificate.

Only the Account Holder of your developer team can create a Developer ID certificate, in Xcode or in your developer account. Apple also offers notarization: an automated scan that gives your signed app a ticket Gatekeeper recognizes. Since 1 November 2023, notarization requires notarytool or Xcode 14 or later.

Note: Some CAs list Apple formats among the files their certificates can sign. For apps your users download and open on a Mac, plan for Developer ID instead.

Can you sign Windows kernel drivers with your certificate?

Not on its own. Since Windows 10 version 1607, Windows does not load new kernel-mode drivers unless Microsoft has signed them through its Hardware Dev Center. Your certificate is still required, but for a different job.

• Register: As of October 2026, Microsoft requires an EV code signing certificate to register for the Windows Hardware Developer Program in Partner Center.
• Submit: You sign each driver package with a certificate registered to your account. Microsoft strongly recommends EV.
• Get signed: Microsoft signs the driver through attestation signing or after Windows Hardware Compatibility Program testing.

Older exceptions, such as systems with Secure Boot turned off, do not help for drivers you ship to customers. Plan for registration early: it includes a check of your organization and cannot finish until your legal contact answers Microsoft’s verification email.