After the CA has decided that you meet its policy criteria, it generates a Software Publisher Certificate that conforms to the industry standard X.509 certificate format with Version 3 extensions. This certificate identifies you and contains your public key. It is stored by the CA for reference and a copy is returned to you via electronic mail. You should review the contents of the certificate. After accepting the certificate, you should include a copy in all published software signed with the private key.
Commercial developers can expect a response to their application in less than two weeks.
While there is no limit to the number of certificates commercial software publishers can obtain, it is up to you to determine who gets a certificate, and how code is signed and distributed. Signing and distributing your software You can now begin signing and distributing software on the Internet. If the hashes do not match, the code has either been modified or the keys are not a matched pair. Depending on the options selected by the user, Microsoft Internet Explorer 3.0 informs the user if the code has not been signed or if the code has been tampered with during the download process. The result is a user who is better informed to make a decision about the software to be downloaded.