OV or EV for SmartScreen in 2026
EV no longer buys instant SmartScreen reputation. Microsoft changed this in 2024: OV and EV files both build reputation through downloads. Pay for EV only to sign kernel-mode drivers, or when a customer's policy requires it.
Every certificate is now short. Since March 2026 a code-signing certificate lasts at most about 15 months (459 to 460 days). A 2- or 3-year purchase is a discount plus free reissues: you reinstall a new certificate along the way.
The key must live on certified hardware (since June 2023), and that is part of the cost:
- A USB token is a one-time cost per order (often $40–140 with shipping, or $379 for SSL.com's YubiKey) and signing is free. But it has to be plugged into the machine that signs.
- Cloud signing works from CI but charges by use: SSL.com's eSigner is $180 a year for 240 signatures on OV.
Timestamp every signature; then it stays valid after the certificate expires.