Keep authentication certificates, passwords and passcodes out of pipeline code and logs.
The authentication certificate (PFX) and its password.
The API user credentials: username and code or passcode.
For the PKCS#11 Wrapper, the ec_pkcs11client.ini file, which contains all of the above.
Never commit PFX files, INI files, passwords or passcodes to the repository.
Store them in the CI system’s secret store and inject them only into the signing step.
Use a dedicated CodeSign Secure user for each pipeline, with only the permissions it needs. See Recommended role design.
Restrict signing jobs to protected branches or tags, so pull requests from forks can’t reach the secrets.
Make sure secret values are masked in job logs, and don’t echo them.
Renew the authentication certificate before its Valid Till date and rotate passcodes on a schedule.
For automated jobs, use a certificate in an environment with No Approval, because approvals time out after 100 seconds. See Designing signing policies.
| Platform | Where to store secrets | Tips |
|---|---|---|
| GitHub Actions | Repository or environment secrets | Use environment secrets with required reviewers for release signing. |
| Jenkins | Credentials (Secret file, Secret text) | Bind them with withCredentials only around the signing step. |
| GitLab CI/CD | CI/CD variables marked Masked and Protected; File-type variables for files | A File-type variable named EC_INI_FILE_PATH is written to a temporary file and the variable holds its path. |
| Azure DevOps | Secure files, secret variables, variable groups linked to Azure Key Vault | Use the DownloadSecureFile task for the INI or PFX file. |
| TeamCity | Password parameters | Password values are hidden in the build log. |
| Bamboo | Plan or global variables | Bamboo masks variables whose names contain password, secret or passphrase. |
The PKCS#11 Wrapper reads the path of its configuration file from EC_INI_FILE_PATH. Keep the INI file (and the PFX it points to) in the secret store and let the platform provide the path at run time.
Create a CI/CD variable of type File named EC_INI_FILE_PATH whose value is the content of your INI file, and mark it Protected.
sign-jar:
stage: sign
rules:
- if: $CI_COMMIT_TAG
script:
- jarsigner -keystore NONE -storetype PKCS11 -storepass NONE -providerClass sun.security.pkcs11.SunPKCS11 -providerArg pkcs11properties.cfg -sigalg SHA256withRSA -tsa http://timestamp.digicert.com -signedjar app-signed.jar app.jar EC-Cert-020
Store the INI file as a Secret file credential with the ID ec-pkcs11-ini.
stage('Sign') {
steps {
withCredentials([file(credentialsId: 'ec-pkcs11-ini', variable: 'EC_INI_FILE_PATH')]) {
sh 'jarsigner -keystore NONE -storetype PKCS11 -storepass NONE -providerClass sun.security.pkcs11.SunPKCS11 -providerArg pkcs11properties.cfg -sigalg SHA256withRSA -tsa http://timestamp.digicert.com -signedjar app-signed.jar app.jar EC-Cert-020'
}
}
}
Upload the INI file to Pipelines > Library > Secure files.
- task: DownloadSecureFile@1
name: ecIni
inputs:
secureFile: 'ec_pkcs11client.ini'
- script: jarsigner -keystore NONE -storetype PKCS11 -storepass NONE -providerClass sun.security.pkcs11.SunPKCS11 -providerArg pkcs11properties.cfg -sigalg SHA256withRSA -tsa http://timestamp.digicert.com -signedjar app-signed.jar app.jar EC-Cert-020
env:
EC_INI_FILE_PATH: $(ecIni.secureFilePath)
Note: Replace EC-Cert-020 with the key label of your signing certificate. The PFX path inside the INI file must point to a location the agent can read. Keep that file on the agent in a folder only the build account can read, or download it in the same job from the secret store.
Install the KSP on a self-hosted agent and set EC_Client_Auth and EC_Client_Pass for the account the agent service runs as. Also maintain the settings in the Registry Editor for the EC KSP.
Store the PFX in a folder only that account can read. See Protect credentials on build machines.
Restart the agent service after you change the variables, so new jobs pick them up.
Hosted, short-lived agents need the client installed in every job. Use self-hosted agents for KSP signing, and contact Encryption Consulting for unattended installation options.