Skip to content

Code Signing and S/MIME

Not every certificate protects a website. Two types solve completely different problems: Code Signing guarantees that a piece of software hasn't been altered since it left the hands of whoever published it, and S/MIME guarantees the same for an email message. If you're looking for a certificate for your website, see the choosing guide instead — this guide covers the other two use cases.

Code Signing: why unsigned software triggers warnings

Modern operating systems (Windows SmartScreen, macOS Gatekeeper) distrust by default any executable, driver or installer that doesn't carry a recognized digital signature. An unsigned installer triggers warnings like "Unknown Publisher" or gets blocked until the user forces execution manually — which tanks install rates and gives the impression of malicious software, even when it's legitimate.

A Code Signing certificate solves this by signing the binary with an identity verified by the CA. The operating system checks the signature, confirms the file hasn't changed since it was signed, and allows execution without the "unknown publisher" warning.

Standard Code Signing vs. Code Signing EV

Code Signing Code Signing EV
Company verification Yes Yes, with extended validation
Where the private key lives Local file or token, requester's choice Mandatory hardware device (USB token or HSM)
Windows SmartScreen reputation Builds gradually with download volume Immediate reputation from the first signature
Suited for Most developers and ISVs Drivers, kernel-mode software, or anyone who needs to eliminate the SmartScreen warning from launch day one

The most relevant practical difference isn't the verification level — it's where the private key is stored. Standard Code Signing has required a hardware-protected key (USB token or HSM) since 2023, per CA/Browser Forum requirement, but EV formalizes that requirement with additional verification and immediate SmartScreen reputation, skipping the "warm-up" period standard Code Signing has.

Some system vendors (Microsoft, for kernel-mode drivers, for example) specifically require Code Signing EV — worth confirming your case's requirement before choosing the standard option.

Personal S/MIME: end-to-end email signing and encryption

S/MIME (Secure/Multipurpose Internet Mail Extensions) does for email what Code Signing does for software: proves the message really came from who claims to have sent it, and that the content wasn't altered along the way.

With a Personal S/MIME certificate, a sender can:

  • digitally sign an email, so the recipient can confirm the sender's identity and the content's integrity;
  • encrypt the email content end to end, readable only by whoever holds the private key matching the recipient's certificate.

Unlike a website certificate, S/MIME is issued to a person, tied to a specific email address — not to a domain.

When each one makes sense

Profile Recommended certificate
Developers and ISVs distributing software outside app stores Code Signing
Manufacturers of drivers or kernel-mode software Code Signing EV
Executives, legal and finance teams exchanging sensitive information by email Personal S/MIME
Companies that need to prove authenticity of official email communications Personal S/MIME

Code Signing and S/MIME are independent of website certificates — a company can perfectly well need a Wildcard for its site, a Code Signing certificate for its product installer, and S/MIME for the leadership team, all at once.

See the Code Signing and S/MIME certificates available at InteSys SSL Certificates

Next Steps