- Home
- Code Signing Software
- DigiCert Software Trust Manager
DigiCert Software Trust Manager
Lehi, Utah, USA
What it is
DigiCert Software Trust Manager helps development teams govern and automate signing across software artifacts, tools, and teams. It supports signing containers, binaries, and packages for Windows, Java, Android, and macOS, with workflows that can run after security checks. Teams can use Signing Manager Controller, command-line tools, or the Click-to-sign graphical application, and connect workflows through native connectors, GitHub Actions, CLI tools, and APIs. Access controls include role- and team-based permissions, policy templates, workflows, and approvals for high-risk signing actions. Logs connect a signed item to its signer and time for audit evidence and incident response. Keys can be stored in FIPS 140-2 Level 3 or Common Criteria EAL4+ HSMs, with regional storage options. Threat detection includes software composition analysis, static binary analysis, Apple notarization scans, and DAST. Use requires a DigiCert ONE host environment, API key, client authentication certificate, certificate password, and two-factor authentication. Pricing is on request, with a 30-day trial.
For and against
For
- Automates signing after security checks.
- Supports Windows, Java, Android, and macOS targets.
- Offers role-based access and approval workflows.
- Provides HSM key storage and regional options.
- Signing logs support audit evidence and incident response.
Against
- Pricing is available on request.
- Requires DigiCert ONE environment and client credentials.
- Two-factor authentication is required for all users.
- Legacy GitHub Action was scheduled for retirement May 1, 2026.
The verdict
Software Trust Manager combines signing automation with access controls, audit logs, and key-protection options. Pricing requires a request, and setup depends on DigiCert ONE credentials and two-factor authentication.
Who it suits
It suits global development and CI/CD teams that sign software releases, as well as teams working on firmware, devices, or operational technology. Teams should be prepared to configure DigiCert ONE access and two-factor authentication.
Plans and prices
Software Trust Manager
Pricing not listed; talk to an expert
Read 30 Sep 2026 · digicert.com
On the record
- Access governance
- It supports role- and team-based project access, policy templates, workflows, and approvals for high-risk signing actions.digicert.com · read 30 Sep 2026
- Account dependencies
- The platform components guide says public DigiCert certificates require a CertCentral account and private trust certificates require DigiCert Private CA setup.docs.digicert.com · read 30 Sep 2026
- Audit evidence
- Signing logs can identify what was signed, by whom, and when for incident response and audit evidence.digicert.com · read 30 Sep 2026
- Audit visibility
- It records signing activity so teams can trace signatures to an owner, time, and policy and use logs for audit evidence.digicert.com · read 30 Sep 2026
- Authentication
- DigiCert requires two-factor authentication for all Software Trust Manager users, including for keypair and certificate generation actions in DigiCert ONE.docs.digicert.com · read 30 Sep 2026
- Authentication requirement
- DigiCert requires two-factor authentication for all Software Trust Manager users, including for DigiCert ONE actions such as keypair and certificate generation.docs.digicert.com · read 30 Sep 2026
- Automation
- Signing workflows can be integrated through native connectors, GitHub Actions, CLI, and APIs.digicert.com · read 30 Sep 2026
- Client operating systems
- SMCTL is listed as compatible with Windows, Linux, macOS, and AIX; compatibility varies by client tool and version.docs.digicert.com · read 30 Sep 2026
- Company headquarters
- DigiCert's press kit lists its address as 2801 North Thanksgiving Way, Suite 500, Lehi, Utah.digicert.com · read 30 Sep 2026
- Deployment options
- The datasheet lists on-premises deployments, including air-gapped environments, as well as public cloud, private cloud, hybrid, and in-country models.knowledge.digicert.com · read 30 Sep 2026
- GitHub Actions status
- DigiCert's documentation says its legacy Code signing with Software Trust Manager GitHub Action was to be retired on May 1, 2026, and recommends migrating to DigiCert Binary Signing.docs.digicert.com · read 30 Sep 2026
- Governance
- The product supports role- and team-based project access, policy templates, workflows, and approvals for high-risk signing actions.digicert.com · read 30 Sep 2026
- Integrations
- Listed integrations include Azure DevOps, CircleCI, GitLab, Gradle, Jenkins, GitHub, and ReversingLabs.knowledge.digicert.com · read 30 Sep 2026
- Intended users
- DigiCert lists global development teams, CI/CD-driven delivery teams, and teams working on firmware, devices, and operational technology among the product's audiences.digicert.com · read 30 Sep 2026
- Key protection
- Keys can be stored in FIPS 140-2 Level 3 or Common Criteria EAL4+ HSMs, with regional key storage options.digicert.com · read 30 Sep 2026
- Plans and pricing
- DigiCert announced Essentials, Advanced, and Premium subscription plans for Software Trust Manager; the opened pages did not state prices.docs.digicert.com · read 30 Sep 2026
- Prerequisites
- Using Software Trust Manager requires a DigiCert ONE host environment, API key, client authentication certificate, and certificate password to access client tools.docs.digicert.com · read 30 Sep 2026
- Purpose
- Software Trust Manager protects software supply chain integrity through code signing, policy enforcement, and controls over key usage and access.knowledge.digicert.com · read 30 Sep 2026
