DigiCert Software Trust Manager
DigiCert Software Trust Manager helps teams control and automate software signing across release artifacts, tools, and people.
What DigiCert Software Trust Manager is
DigiCert Software Trust Manager helps teams control and automate software signing across release artifacts, tools, and people. It can sign containers, binaries, and other files after security checks, including Windows packages, Java archives, Android APK/AAB files, and macOS application and installer formats. Teams can work through Signing Manager Controller, command-line tools, or the Click-to-sign graphical app, and connect signing workflows through native connectors, GitHub Actions, CLI tools, and APIs. Role- and team-based access, policy templates, workflows, and approvals help govern sensitive signing actions. Logs link signed items to an owner and time for audit evidence and incident response. Keys can be held in FIPS 140-2 Level 3 or Common Criteria EAL4+ HSMs, with regional storage options. Threat detection includes software composition analysis, static binary analysis, Apple notarization scans, and DAST. Use requires a DigiCert ONE host environment, API credentials and certificate details, and two-factor authentication. Pricing is on request, with a 30-day trial listed.
Good
- Automates signing after security checks.
- Supports multiple artifact types and operating systems.
- Includes role-based access and approval workflows.
- HSM key protection and regional storage options.
- Signing logs support audit evidence.
Watch out
- Pricing is available on request.
- Requires a DigiCert ONE host environment and credentials.
- Two-factor authentication is required for all users.
- Legacy GitHub Action retirement was scheduled for May 1, 2026.
Who it suits
It suits global development, CI/CD, firmware, device, and operational-technology teams that need governed software signing. Teams should account for the required DigiCert ONE environment and authentication setup.
Verdict
Software Trust Manager combines signing automation with access controls, security checks, and traceable logs. Its setup dependencies and on-request pricing are important considerations for teams evaluating it.
Plans and prices
From DigiCert Software Trust Manager's own pricing page, checked 30 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Software Trust Manager | Priced on request | Pricing not listed; talk to an expert |
The facts
Each one read from DigiCert Software Trust Manager's own pages, with the date it was checked.
What it does
- Access governance
- It supports role- and team-based project access, policy templates, workflows, and approvals for high-risk signing actions.checked 30 Sep 2026
- Account dependencies
- The platform components guide says public DigiCert certificates require a CertCentral account and private trust certificates require DigiCert Private CA setup.checked 30 Sep 2026
- Audit evidence
- Signing logs can identify what was signed, by whom, and when for incident response and audit evidence.checked 30 Sep 2026
- Audit visibility
- It records signing activity so teams can trace signatures to an owner, time, and policy and use logs for audit evidence.checked 30 Sep 2026
- Authentication
- DigiCert requires two-factor authentication for all Software Trust Manager users, including for keypair and certificate generation actions in DigiCert ONE.checked 30 Sep 2026
- Authentication requirement
- DigiCert requires two-factor authentication for all Software Trust Manager users, including for DigiCert ONE actions such as keypair and certificate generation.checked 30 Sep 2026
- Automation
- Signing workflows can be integrated through native connectors, GitHub Actions, CLI, and APIs.checked 30 Sep 2026
- Client operating systems
- SMCTL is listed as compatible with Windows, Linux, macOS, and AIX; compatibility varies by client tool and version.checked 30 Sep 2026
- Deployment options
- The datasheet lists on-premises deployments, including air-gapped environments, as well as public cloud, private cloud, hybrid, and in-country models.checked 30 Sep 2026
- GitHub Actions status
- DigiCert's documentation says its legacy Code signing with Software Trust Manager GitHub Action was to be retired on May 1, 2026, and recommends migrating to DigiCert Binary Signing.checked 30 Sep 2026
- Governance
- The product supports role- and team-based project access, policy templates, workflows, and approvals for high-risk signing actions.checked 30 Sep 2026
- Integrations
- The product integrates through native connectors, GitHub Actions, CLI tools, and APIs.checked 30 Sep 2026
- Intended users
- DigiCert lists global development teams, CI/CD-driven delivery teams, and teams working on firmware, devices, and operational technology among the product's audiences.checked 30 Sep 2026
- Key protection
- Keys can be stored in FIPS 140-2 Level 3 or Common Criteria EAL4+ HSMs, with regional key storage options.checked 30 Sep 2026
- Prerequisites
- Using Software Trust Manager requires a DigiCert ONE host environment, API key, client authentication certificate, and certificate password to access client tools.checked 30 Sep 2026
- Purpose
- Software Trust Manager governs software signing across artifacts, tools, and teams.checked 30 Sep 2026
- Security testing
- The datasheet lists integrated application security testing (DAST) to identify code security weaknesses.checked 30 Sep 2026
- Signing tools
- It offers Signing Manager Controller, a CLI, and DigiCert Click-to-sign, a GUI application.checked 30 Sep 2026
- Signing workflows
- It can automate release signing after security checks and sign containers, binaries, and other artifacts.checked 30 Sep 2026
- Supported client operating systems
- DigiCert client tools have downloads for Windows, macOS, and Linux.checked 30 Sep 2026
The company
- Company headquarters
- DigiCert's press kit lists its address as 2801 North Thanksgiving Way, Suite 500, Lehi, Utah.checked 30 Sep 2026
- Founded
- 2003checked 23 Sep 2026
- Headquarters
- Lehi, Utah, USAchecked 23 Sep 2026
Money
- Plans and pricing
- DigiCert announced Essentials, Advanced, and Premium subscription plans for Software Trust Manager; the opened pages did not state prices.checked 30 Sep 2026
Alternatives to DigiCert Software Trust Manager
- 1
Sigstore
Free planOpen sourceWebAPILinuxmacOS7.6Free plan - 2
SignPath
Free planWebAPILinuxmacOS7.2Free plan - 3
AWS Signer
Free planWebAPILinuxmacOS7.1Free plan - 4
Cosign
Free planLinuxmacOSSelf-hostedWindows6.6Free plan - 5
OpenPubkey
Free planAPILinuxmacOSSelf-hosted6.6Free plan - 6
SignServer
Free planWebAPILinuxmacOS6.5Free plan