The process of order a Code Signing Certificate has been changed since about 2023. Now you have to use a physical USB key to code sign both your app and your installer. Unless you already have the yubikey, you might only have to update your existing yubikey.
1. Order an OV Code Signing Certificate
I did decide to use Comodo (Sectigo) when ordering a certificate. Roughly $500. Start by ordering an Organization Validation (OV) code signing certificate from Comodo/Sectigo and provide the necessary details about your organization. Note that if you have to order an USB key the first time. As the delivery of certificate will be "physical" since 2023. If you already have the "key", you can order a digital certificate.
2. Verify Identity and Organization
Submit proof of identity for the person serving as your “admin contact” for the Code Signing order. This includes a government-issued photo ID card and a photo of yourself holding the ID card. Also, verify the legal existence of your organization and its physical address. Sectigo will call the organization to verify and approve the certificate request. This step ensures that the person listed as the signer is authorized to act on behalf of the organization.
3. Verify Phone Number
A phone number belonging to the organization must be verified. This can be done through a third-party business directory or official government website. Do not forget country prefix.
4. Final Approval
After all details are verified, Sectigo will review the information and issue the certificate. You will receive instructions via email to collect the certificate. Either digigally (existing USB key) or physically (UPS delivery)
5. Confirming mail
When the USB is sent, you get a mail with USB tracking ID and Token Password. you may also need to install additional software to access the certificate on the selected media (token/smartcard), we suggest downloading SafeNet, however there are many applications you can utilize.
6. Customs duty
Outside US, there may be an import fee added afterwards. In my case about $30. The fee can be prepaid or COD (cash on delivery). You find the fee on the UPS tracking site.
7. Receive the Certificate on a USB Token
Sectigo will send your code signing certificate and key on a FIPS-compliant USB token. This USB token is a hardware device that securely stores your certificate and private key, ensuring they are not exposed to potential security threats.
