Freedom251 › Code Signing Software
DigiCert Software Trust Manager
What DigiCert Software Trust Manager is
DigiCert Software Trust Manager governs software signing across artifacts, tools, and teams. Signing options include Signing Manager Controller, command-line tools, and the Click-to-sign graphical application. Teams can automate release signing after security checks and sign containers, binaries, and other artifacts, including Windows packages, Java archives, Android APK/AAB files, and macOS application and installer formats. Access controls include role- and team-based project permissions, policy templates, workflows, and approvals for high-risk signing actions. Signing logs record what was signed, by whom, and when, supporting audit evidence and incident response. Keys can be stored in FIPS 140-2 Level 3 or Common Criteria EAL4+ HSMs, with regional storage options. Threat detection includes software composition analysis, static binary analysis, Apple notarization scans, and DAST. Integrations include native connectors, CLI tools, and APIs. Use requires a DigiCert ONE host environment, API key, client authentication certificate, and certificate password; users must also use two-factor authentication. Pricing is on request, and a 30-day trial is listed.
Who it suits
Software Trust Manager suits development teams managing signing across release artifacts and tools, including CI/CD-driven teams and teams working on firmware, devices, or operational technology. It may also suit teams that need signing approvals and audit logs.
What it does well
- Automates signing after security checks
- Supports approval workflows for high-risk signing
- Logs identify what was signed, by whom, and when
- Offers HSM key protection and regional storage
- Lists on-premises and multiple cloud deployment models
What to know first
- Pricing is available on request
- Requires a DigiCert ONE environment and credentials
- Two-factor authentication is required for all users
- Public certificates require a CertCentral account
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Software Trust Manager | Pricing not listed; talk to an expert | On request |
As digicert.com lists them, read 30 Sept 2026. The maker's own page has the final word.
Verdict
Software Trust Manager combines signing automation with access governance, audit logs, and protected key storage. Before adopting it, account for its DigiCert ONE prerequisites and required two-factor authentication.
Facts from DigiCert Software Trust Manager's own pages
- Access governance
- It supports role- and team-based project access, policy templates, workflows, and approvals for high-risk signing actions. · digicert.com, 30 Sept 2026
- Account dependencies
- The platform components guide says public DigiCert certificates require a CertCentral account and private trust certificates require DigiCert Private CA setup. · docs.digicert.com, 30 Sept 2026
- Audit evidence
- Signing logs can identify what was signed, by whom, and when for incident response and audit evidence. · digicert.com, 30 Sept 2026
- Audit visibility
- It records signing activity so teams can trace signatures to an owner, time, and policy and use logs for audit evidence. · digicert.com, 30 Sept 2026
- Authentication
- DigiCert requires two-factor authentication for all Software Trust Manager users, including for keypair and certificate generation actions in DigiCert ONE. · docs.digicert.com, 30 Sept 2026
- Authentication requirement
- DigiCert requires two-factor authentication for all Software Trust Manager users, including for DigiCert ONE actions such as keypair and certificate generation. · docs.digicert.com, 30 Sept 2026
- Automation
- Signing workflows can be integrated through native connectors, GitHub Actions, CLI, and APIs. · digicert.com, 30 Sept 2026
- Client operating systems
- SMCTL is listed as compatible with Windows, Linux, macOS, and AIX; compatibility varies by client tool and version. · docs.digicert.com, 30 Sept 2026
- Company headquarters
- DigiCert's press kit lists its address as 2801 North Thanksgiving Way, Suite 500, Lehi, Utah. · digicert.com, 30 Sept 2026
- Deployment options
- The datasheet lists on-premises deployments, including air-gapped environments, as well as public cloud, private cloud, hybrid, and in-country models. · knowledge.digicert.com, 30 Sept 2026
- Founded
- 2003 · digicert.com, 23 Sept 2026
- GitHub Actions status
- DigiCert's documentation says its legacy Code signing with Software Trust Manager GitHub Action was to be retired on May 1, 2026, and recommends migrating to DigiCert Binary Signing. · docs.digicert.com, 30 Sept 2026
- Governance
- The product supports role- and team-based project access, policy templates, workflows, and approvals for high-risk signing actions. · digicert.com, 30 Sept 2026
- Headquarters
- Lehi, Utah, USA · digicert.com, 23 Sept 2026
- Integrations
- The product integrates through native connectors, GitHub Actions, CLI tools, and APIs. · digicert.com, 30 Sept 2026
- Intended users
- DigiCert lists global development teams, CI/CD-driven delivery teams, and teams working on firmware, devices, and operational technology among the product's audiences. · digicert.com, 30 Sept 2026
- Key protection
- Keys can be stored in FIPS 140-2 Level 3 or Common Criteria EAL4+ HSMs, with regional key storage options. · digicert.com, 30 Sept 2026
- Plans and pricing
- DigiCert announced Essentials, Advanced, and Premium subscription plans for Software Trust Manager; the opened pages did not state prices. · docs.digicert.com, 30 Sept 2026
- Prerequisites
- Using Software Trust Manager requires a DigiCert ONE host environment, API key, client authentication certificate, and certificate password to access client tools. · docs.digicert.com, 30 Sept 2026
- Purpose
- Software Trust Manager governs software signing across artifacts, tools, and teams. · digicert.com, 30 Sept 2026
- Security testing
- The datasheet lists integrated application security testing (DAST) to identify code security weaknesses. · knowledge.digicert.com, 30 Sept 2026
- Signing tools
- It offers Signing Manager Controller, a CLI, and DigiCert Click-to-sign, a GUI application. · docs.digicert.com, 30 Sept 2026
- Signing workflows
- It can automate release signing after security checks and sign containers, binaries, and other artifacts. · digicert.com, 30 Sept 2026
- Supported client operating systems
- DigiCert client tools have downloads for Windows, macOS, and Linux. · docs.digicert.com, 30 Sept 2026
Where DigiCert Software Trust Manager stands on Freedom251
- Code Signing Software#16 of 28