Skip to content
SPECIFICTION
Get listed

DigiCert Software Trust Manager

digicert.com

WebWindowsmacOSLinuxAPI
Visit digicert.com
Spec score 8.3 #5 of 28 in Code Signing Software

What it is

DigiCert Software Trust Manager governs and automates software signing across artifacts, tools, and teams. Signing workflows can run after security checks and cover containers, binaries, and other artifacts, including Windows packages, Java archives, Android APK/AAB files, and macOS application and installer formats. Teams can use Signing Manager Controller, command-line tools, or the Click-to-sign graphical application, and connect workflows through native connectors, GitHub Actions, CLI tools, and APIs. Role- and team-based access, policy templates, workflows, and approvals govern high-risk signing actions. Logs link signed items to an actor and time for audits and incident response. Keys can be stored in FIPS 140-2 Level 3 or Common Criteria EAL4+ HSMs, with regional storage options. Threat detection includes software composition analysis, static binary analysis, Apple notarization scans, and DAST. Use requires a DigiCert ONE host environment, API key, client authentication certificate, and certificate password; two-factor authentication is required for all users. Pricing is on request, and a 30-day trial is listed.

Spec sheet

Purpose
Software Trust Manager protects software supply chain integrity through code signing, policy enforcement, and controls over key usage and access.Read 30 Sep 2026 · knowledge.digicert.com
Intended users
DigiCert lists global development teams, CI/CD-driven delivery teams, and teams working on firmware, devices, and operational technology among the product's audiences.Read 30 Sep 2026 · digicert.com
Integrations
Listed integrations include Azure DevOps, CircleCI, GitLab, Gradle, Jenkins, GitHub, and ReversingLabs.Read 30 Sep 2026 · knowledge.digicert.com
Headquarters
Lehi, Utah, USARead 23 Sep 2026 · digicert.com
Founded
2003Read 23 Sep 2026 · digicert.com
Access governance
It supports role- and team-based project access, policy templates, workflows, and approvals for high-risk signing actions.Read 30 Sep 2026 · digicert.com
Account dependencies
The platform components guide says public DigiCert certificates require a CertCentral account and private trust certificates require DigiCert Private CA setup.Read 30 Sep 2026 · docs.digicert.com
Audit evidence
Signing logs can identify what was signed, by whom, and when for incident response and audit evidence.Read 30 Sep 2026 · digicert.com
Audit visibility
It records signing activity so teams can trace signatures to an owner, time, and policy and use logs for audit evidence.Read 30 Sep 2026 · digicert.com
Authentication
DigiCert requires two-factor authentication for all Software Trust Manager users, including for keypair and certificate generation actions in DigiCert ONE.Read 30 Sep 2026 · docs.digicert.com
Authentication requirement
DigiCert requires two-factor authentication for all Software Trust Manager users, including for DigiCert ONE actions such as keypair and certificate generation.Read 30 Sep 2026 · docs.digicert.com
Automation
Signing workflows can be integrated through native connectors, GitHub Actions, CLI, and APIs.Read 30 Sep 2026 · digicert.com
Client operating systems
SMCTL is listed as compatible with Windows, Linux, macOS, and AIX; compatibility varies by client tool and version.Read 30 Sep 2026 · docs.digicert.com
Company headquarters
DigiCert's press kit lists its address as 2801 North Thanksgiving Way, Suite 500, Lehi, Utah.Read 30 Sep 2026 · digicert.com
Deployment options
The datasheet lists on-premises deployments, including air-gapped environments, as well as public cloud, private cloud, hybrid, and in-country models.Read 30 Sep 2026 · knowledge.digicert.com
GitHub Actions status
DigiCert's documentation says its legacy Code signing with Software Trust Manager GitHub Action was to be retired on May 1, 2026, and recommends migrating to DigiCert Binary Signing.Read 30 Sep 2026 · docs.digicert.com
Governance
The product supports role- and team-based project access, policy templates, workflows, and approvals for high-risk signing actions.Read 30 Sep 2026 · digicert.com
Key protection
Keys can be stored in FIPS 140-2 Level 3 or Common Criteria EAL4+ HSMs, with regional key storage options.Read 30 Sep 2026 · digicert.com
Plans and pricing
DigiCert announced Essentials, Advanced, and Premium subscription plans for Software Trust Manager; the opened pages did not state prices.Read 30 Sep 2026 · docs.digicert.com
Prerequisites
Using Software Trust Manager requires a DigiCert ONE host environment, API key, client authentication certificate, and certificate password to access client tools.Read 30 Sep 2026 · docs.digicert.com
Security testing
The datasheet lists integrated application security testing (DAST) to identify code security weaknesses.Read 30 Sep 2026 · knowledge.digicert.com
Signing tools
It offers Signing Manager Controller, a CLI, and DigiCert Click-to-sign, a GUI application.Read 30 Sep 2026 · docs.digicert.com
Signing workflows
It supports signing through SMCTL, a command-line tool, and DigiCert Click-to-sign, a graphical application.Read 30 Sep 2026 · docs.digicert.com
Supported client operating systems
DigiCert client tools have downloads for Windows, macOS, and Linux.Read 30 Sep 2026 · docs.digicert.com
Threat detection
Threat detection includes software composition analysis, static binary analysis, and Apple notarization scans.Read 30 Sep 2026 · docs.digicert.com

Plans and prices

Software Trust Manager Priced on request Pricing not listed; talk to an expert Read 30 Sep 2026 · digicert.com

Every DigiCert Software Trust Manager plan and price →

Strong points and limits

Strong points

  • Automates signing after security checks.
  • Supports policy controls and high-risk approvals.
  • HSM options include FIPS 140-2 Level 3.
  • Signing logs support audit evidence.
  • Available with a 30-day trial.

Limits

  • Requires DigiCert ONE environment and credentials.
  • Two-factor authentication is mandatory.
  • Pricing is on request.
  • Legacy GitHub Action was slated for retirement May 1, 2026.

Who it suits

It suits development and delivery teams that need signing controls across software releases, including teams working on firmware, devices, and operational technology. Teams should be prepared to meet the DigiCert ONE, credential, and two-factor authentication requirements.

Verdict

Software Trust Manager combines signing automation with access governance, audit logging, and key-protection options. Check the required DigiCert ONE setup and the documented GitHub Action migration before selecting an integration path.

Where Specifiction places it

Alternatives to DigiCert Software Trust ManagerAll alternatives →