The process for allowing organizations to securely create and manage certificates to digitally sign software via a Code Signing Certificate enrollment process within SCM (Sectigo Certificate Manager) is provided in this guide.

This guide tells about the entire enrollment process from the point of completing certificate profile creation and certificate submission.

Prerequisites

Before beginning enrollment, ensure you have:

• An account with the Sectigo Certificate Manager
• An account manager who has been granted administrative access to perform the Code Signing Certificate enrollment process.
• A complete Code Signing Certificate profile
• A Certificate Signing Request (CSR) that has been generated in a PEM format.
• If your account requires Key Attestation, it must be enabled before you can enroll for a Code Signing Certificate.

If you have an EV Code Signing Certificate, you must have completed the organization and extension validation requirements before submitting the certificate.

Steps to Enroll a Code Signing Certificate in SCM

• Log in to SCM as an administrator (MRAO role).
• Navigate to Enrollment → Certificate Profiles.
• Click Add to create a new profile.
• Complete the required fields: Name, CA Backend, Certificate Type (Code Signing Certificate), Template (OV or EV), Terms (validity period)
• Click Save.

The certificate profile defines issuance rules and validation requirements.

• Navigate to Organization → Certificate Settings.
• Enable Code Signing Certificates.
• Assign the newly created profile to your organization.

Without delegation, users cannot request certificates for that profile.

• Navigate to Enrollment → Enrollment Forms.
• Click Add (+) to create a new form.
• Configure the form: Code Signing Certificate Enrollment Form, Generate URL Extension, and Authentication Method (Email Confirmation or Secret ID).
• Click Save.

To make the form usable:

• Select the form
• Go to Accounts → Add (+)
• Enter account details
• Assign the appropriate certificate profile

This step connects the enrollment form to the certificate profile.

• Navigate to Certificates → Code Signing Certificates.
• Click Invitations → Add (+).
• Enter: Recipient’s email address, Enrollment endpoint (the form created earlier), and Associated account.
• Click Send.

The recipient will receive an email containing the enrollment link.

The recipient must:

• Open the invitation email.
• Click the enrollment link.
• Fill in the required details: Certificate Email (SAN, if applicable), First Name / Last Name, Certificate Term.
• Upload: CSR in PEM format, Key Attestation file (if required)
• Submit the form.

After submission of a certificate request, it is placed in a process for validation. Once it has been approved, it will be authorized for distribution through the SCM.

Conclusion

Regardless of how you enroll (i.e., either using SCM or creating your own hardware-based key storage), our staff will make sure that the certificate has been issued according to all relevant policies and procedures. Contact SignMyCode today to start protecting your applications via a code-signing solution from an established name in the industry.

Cheap Code Signing Certificates

Prevent Code Tampering and Authenticate Code Integrity by Digitally Sign your Code with Trusted Code Signing Certificates.

Starting at Just $215.99/Year