Should you get a code signing certificate?

(this article is part of a series)

Code signing certificates let users validate that a piece of software came from a certain provider.

Certificates only let users validate where the software came from. They don't certify that the program is actually safe to run. "Bob's Malicious Software" can get a certificate just like Microsoft's.

When a user tries to run an executable without a certificate after downloading, they get a warning message from Internet Explorer saying that the source of the program can't be verified.

Signed executables still display a warning message, but it includes the name of the software vendor. The difference is pretty subtle, but I can still see some users bailing out of an install if it's not signed.

About a year ago I stumbled across a deal where I could get such a certificate for about $100, as opposed to the more typical $200 pricing. This seemed cheap enough where I should try signing my anti-spam software to see if helped with sales.

A year has now past and the certificate has expired. Is it worth renewing?

The real question is - are users really more prone to install the anti-spam program now that it's been signed? Let's see what the logs say.

The 3.7% difference might not sound like much, but it really works out to a total 6.5% increase in installed base.

If installs are linearly related to sales - that's a 6.5% increase in sales.

In other words, someone who is selling $2000 a year in software not using a certificate might expect $130 extra in sales if they signed their code.

Since at least one place is offering code signing certificates for under $100, it seems like anyone selling more than a $1000 or so should consider getting one.

Needless to say, I'm renewing my certificate - and will probably take more care to make sure it doesn't expire again.

Back