Create, use, monitor, renew and retire signing keys and certificates in CodeSign Secure.
Create a key pair in the HSM with a self-signed certificate or a CSR.
Assign the certificate to an environment and map it to teams in an application.
Use it from build machines through the client tools.
Monitor expiry with triggers, the Dashboard and the Certificate Report.
Renew before it expires.
Retire it by deactivating it once it is no longer needed.
| Method | Key generated in the HSM | Environment chosen | Use for |
|---|---|---|---|
| Self Signed Certificate | Yes | On the form | Internal testing and development. Operating systems don’t trust these certificates. |
| Certificate Signing Request (CSR) | Yes, a new key pair every time | When you import the issued certificate | Publicly trusted or enterprise-CA certificates for production |
| Import Certificate | No, it uses the key created with the CSR | On the form | Uploading the certificate your CA issued for a CSR created in CodeSign Secure |
| Algorithm | Options in the Key Algorithm list |
|---|---|
| RSA | 2048, 3072, 4096 bits |
| ECDSA | P-256, P-384, P-521 (shown as 256, 384 and 521) |
Note: Public certificate authorities require code-signing RSA keys of at least 3072 bits. Check which ECDSA curves your CA accepts before you generate the CSR.
| Field | Required | Description |
|---|---|---|
| Certificate Name | Yes | The name shown in CodeSign Secure |
| Common Name | Yes | Certificate subject CN, usually your organization or product publisher name |
| Organization, Organization Unit | Yes | Subject O and OU |
| Valid From, Valid To | Yes | Validity period |
| Environment | Yes | The environment whose approval policy applies. Only active environments are listed. |
| Certificate Description | Yes | Free text |
| Country Code, State/Province, Locality, Email | Yes | Subject C, ST, L and email address. The country code is two letters. |
| Key Algorithm | Yes | RSA 2048/3072/4096 or ECDSA 256/384/521. Default RSA 4096. |
| Reproducible Build Key Usage | No | None (default), Pre-Sign Hash Validation or Post-Sign Hash Validation |
| Key Renewal | No | True reissues the certificate with the same key in the HSM when it is renewed. Available for self-signed certificates only. |
The CSR form has the same subject fields as the self-signed form (Certificate Name, Common Name, Organization, Organization Unit, Certificate Description, Country Code, State/Province, Locality, Email), plus Key Algorithm and Reproducible Build Key Usage. It has no validity dates, because the CA sets them, and no environment, which you choose when you import the issued certificate.
| Field | Required | Description |
|---|---|---|
| Certificate Name | Yes | The file name of the uploaded certificate. This should match the certificate name used when creating the CSR. |
| Environment | Yes | The environment whose approval policy applies |
| Certificate File | Yes | The certificate your CA issued for a CSR created in CodeSign Secure |
| Certificate Description | Yes | Free text |
| Reproducible Build Key Usage | No | None, Pre-Sign Hash Validation or Post-Sign Hash Validation |
Each certificate belongs to one environment. Change it with right-click > Edit Environment. Only active environments can be selected.
A certificate appears in App Management’s team mapping only after it has an environment.
Only members of teams mapped to the certificate can sign with it.
Setup Trigger: right-click the certificate, enter Additional Email IDs and Trigger Days. The alert is sent that many days before expiry. Set at least 30 days so there is time to renew.
Dashboard: the Certificates Issued chart shows Active, Inactive, and Expired certificates over the last four months.
Certificate Report: the expiry chart groups certificates into 0–7, 7–30, 30–60, 60–90 and 90+ days.
When a certificate passes its end date, its status becomes Expired, and it can no longer be used to sign.
If Key Renewal is True, CodeSign Secure reissues the certificate with the same key in the HSM. After a renewal, download the new certificate and replace the old copy wherever it is used, for example, the file passed to SignTool with /f.
Renewing a CA-issued certificate creates a new key, because every CSR generates a new key pair in the HSM.
Generate a new CSR in Keys and Certificates and submit it to your CA.
Import the issued certificate and select the environment.
In App Management, edit each application that used the old certificate and map the new certificate to the same teams.
Update pipelines and build machines with the new key name or label and the new certificate file.
Sign and verify a test file with the new certificate.
Deactivate the old certificate once nothing uses it.
Tip: Files signed with a timestamp stay valid after the old certificate expires. You don’t need to re-sign them. See Timestamping.
Deactivate (right-click > Activate/Deactivate) stops the certificate from being used for new signing requests without deleting the key. You can activate it again later.
If your policy requires a key to be destroyed, the HSM administrator removes it on the HSM after you confirm it is no longer needed.
Revocation is done by the CA that issued the certificate. After the CA revokes it, deactivate the certificate in CodeSign Secure. Depending on the revocation date the CA sets, signatures made after that date are no longer trusted.
Since 1 June 2023, the CA/Browser Forum requires private keys for publicly trusted code-signing certificates to be generated and stored in certified hardware. CodeSign Secure generates keys inside a FIPS 140-2 Level 3 HSM.
Some CAs ask for key attestation, which is proof that the key was generated in an HSM. Attestation is produced with the HSM vendor’s tools and also in CodeSign Secure reports. Ask your CA which format it accepts, and contact Encryption Consulting if you need help collecting it for a key created in CodeSign Secure.