Code Signing Key Storage Requirements: Hardware Tokens, HSMs and Cloud Signing

Every publicly trusted code signing certificate now needs a code signing hardware token, a hardware security module (HSM) or a cloud signing service that keeps the private key in certified hardware. Since June 1, 2023, the CA/Browser Forum’s code signing rules no longer allow the key to sit in a file on your PC or build server. This applies to standard (OV) and EV certificates alike.

The private key is the secret half of your certificate: whoever holds it can sign software in your name. Locking it inside hardware means malware cannot copy it, even if it takes over the machine. If you are still comparing certificate types, our overview of code signing vs SSL explains how the two differ.

Key fact	Detail
Rule	CA/Browser Forum Code Signing Baseline Requirements
In force since	June 1, 2023
Hardware standard	FIPS 140-2 Level 2 or higher, or Common Criteria EAL 4+
Applies to	Standard (OV) and EV code signing certificates
Your options	USB hardware token, your own HSM, or a CA cloud signing service

Why do code signing certificates need a hardware token?

Because the CA/Browser Forum requires it: since June 1, 2023, code signing private keys must be generated and stored in a hardware crypto module certified to FIPS 140-2 Level 2 (or higher) or Common Criteria EAL 4+. A certificate authority may not issue a code signing certificate for a key it cannot confirm is protected that way.

FIPS 140-2 is the US government standard for cryptographic hardware; Level 2 adds tamper evidence and role-based login. Common Criteria EAL 4+ is the international equivalent many HSMs carry. The rule exists because stolen signing keys let attackers ship malware that looks like your software.

For you, the practical effect is simple. You can no longer download a .pfx file and sign from any machine. You either receive a token, prove that your own HSM generated the key, or sign through a cloud service run by the CA.

Note: As of March 1, 2026, the CA/Browser Forum also limits new code signing certificates to a maximum of 460 days (ballot CSC-31). Expect to renew and reissue more often than with older multi-year certificates, so plan your key storage with that rhythm in mind.

Can I use a cloud HSM instead of a USB token?

Yes, if your certificate authority supports it. You can either use the CA’s own cloud signing service or install the certificate on a cloud HSM you rent, provided the CA accepts proof that the key was generated inside that HSM. Options differ per CA and product, so check before you order.

CA	Options to confirm when ordering (as of October 2026)
DigiCert	Hardware token, your own compliant HSM, or DigiCert KeyLocker – a cloud service with FIPS 140-2 Level 3 key storage
Sectigo	Hardware token or your own compliant HSM; ask us which cloud signing option is currently available for your product

If you bring your own HSM, the CA typically asks for a key attestation (a signed statement from the HSM that the key was created inside it) or an auditor’s letter. Cloud provider HSMs can qualify, but confirm with us that the CA accepts your specific service before you generate the key. Contact our team at our support team if you are unsure.

Can I use one code signing hardware token on several build servers?

Not easily. A USB token is a physical device that plugs into one machine at a time, so several build servers either share it over the network or take turns. For distributed or automated builds, cloud signing is the cleaner option.

• Physical access: the token must be attached to the machine that signs. Cloud build agents usually cannot reach it.
• USB over network: USB-over-IP devices can expose a token to several servers, but they add a point of failure.
• PIN prompts: token software often asks for the PIN interactively, which breaks unattended builds. Some token clients can cache the PIN for a session; check your token’s documentation.
• One certificate, one key: you cannot copy the key to a second token. A second token means a second certificate or a reissue.

What happens if I lose the token?

Revoke the certificate right away and order a reissue on a new token. The key cannot be recovered or exported from a lost token, so the old certificate is unusable either way.

If you believe someone else may have the token and its PIN, report it as a key compromise. The CA can then set the revocation date to the time the key may have been misused. Signatures with a trusted timestamp from before that date stay valid; signatures made after it stop validating. That is one reason to timestamp every signature.

Situation	What to do
Token lost, PIN unknown to others	Revoke, request a reissue on a new token, re-sign upcoming releases
Token stolen or PIN exposed	Report key compromise, revoke with the compromise date, reissue, review recent signed builds
Token locked after wrong PINs	Contact the CA or token vendor; a reset may erase the key and require a reissue
Token broken	Treat it like a lost token: revoke and reissue

Tip: Keep the token PIN and administrator PIN in a password manager, store the token in a locked place and log who uses it.

How to choose the right key storage option

Pick the option that matches how and where you build software. The certificate itself is the same; only the place the key lives changes.

• One developer, occasional releases: a hardware token is the simplest and needs no extra infrastructure.
• Automated builds or several build servers: a CA cloud signing service avoids sharing a USB device and handles access per user or pipeline.
• Company with existing HSMs: use your own HSM if the CA accepts its key attestation; you keep full control of the key.

Decide before you order. Changing from a token to an HSM or cloud service later usually means a reissue with a new key.

Next step: signing your first build

Once your key storage is in place, the signing process itself is the same for tokens, HSMs and cloud services. Our guide shows how to sign Windows applications with SignTool, including timestamping. When you are ready to order, compare code signing certificates and pick the delivery option at checkout.