Secure your software supply chain, from commit to deployment
Industries / Software & DevOps
Trust is the invisible layer of every software release
What SSL.com provides for Software & DevOps teams
Relevant frameworks and requirements
Microsoft Authenticode
Windows SmartScreen evaluates binary reputation based on valid code signatures. SSL.com OV and EV Code Signing certificates sign MSI, EXE, PS1, and .cat catalog files for Authenticode-compliant distribution across all supported Windows versions.
Apple Gatekeeper / Notarization
macOS Gatekeeper blocks unsigned applications from running. SSL.com Apple-Issued Developer ID certificates support Notarization workflows so downloaded apps are approved automatically with no security warnings.
SLSA
The Supply-chain Levels for Software Artifacts framework specifies build integrity tiers. Levels 2-4 require signed provenance; SSL.com signing certificates produce the cryptographic attestations required for SLSA v1.0 Build and Provenance tracks.
SOC 2 Type II
SOC 2 availability and security criteria include certificate lifecycle management as a key control. SSL.com Managed PKI with automated ACME renewal eliminates expired-certificate outages that trigger SOC 2 findings.
NIST SP 800-218
The Secure Software Development Framework requires code signing as a critical integrity practice at PW.6 and PS.2. SSL.com code signing certificates meet the cryptographic strength and key protection requirements for SSDF compliance.
CA/B Forum Code Signing BR
SSL.com issues OV, IV, and EV Code Signing certificates under current CA/Browser Forum Baseline Requirements with hardware-backed key protection per the June 2023 key storage mandate.
