This walkthrough takes a new CodeSign Secure installation from the first sign-in to a verified, audited signature. It uses the Windows KSP with SignTool, the most common path. Each step links to the page with full details.
Note: This walkthrough signs a Windows executable with the Encryption Consulting KSP and SignTool. For other file types and signing tools, see Supported Formats and Platforms and Signing Capabilities.
A CodeSign Secure server is installed and reachable over HTTPS. See Installing the server.
You can sign in as a user with the System Admin role.
A Windows 10 or Windows 11 build machine with the Windows SDK installed, so that signtool.exe is available.
A file to sign, for example setup.exe.
Open https://<your domain>/ and sign in with your email and password, or with Azure AD if an identity store is configured. On the Dashboard, scroll to HSM Health Check and confirm the status is Active. If it is inactive, fix the HSM connection before continuing (see Troubleshooting).
An environment decides whether a signing request needs approval. Go to System Setup > Environment > Create Environment and create at least two environments:
| Environment | Policy Type | Needs MFA | Use it for |
|---|---|---|---|
| Dev | No Approval | Off | Test signing and automated pipelines |
| Production | Quorum | On | Release builds that customers install |
For more patterns, see Designing signing policies.
Go to System Setup > User > Register User. Enter the email, first name, last name and password, and select one or more roles.
Go to System Setup > Roles and Permissions. Every role except System Admin starts with no permissions. Right-click the role, select Edit Permissions and switch on what that role needs, for example CodeSigning Operation and Sign tools for developers.
Make sure the people who approve production requests hold the System Admin or Project Manager role. Only those roles can be approvers.
See Roles and Permissions for the full permission list and a recommended role design.
Go to Keys and Certificates > Add New Certificate. The private key is always generated inside the HSM.
For a first test: choose Self Signed Certificate, select the Dev environment and a key algorithm such as RSA 3072.
For production: choose Certificate Signing Request, submit the CSR to your certificate authority, then use Import Certificate to upload the issued certificate and select the Production environment. Make sure the imported certificate file name is the same as the certificate name you gave during the CSR generation.
Field details, supported algorithms and renewal are covered in Key and Certificate Lifecycle.
Go to App Management > Add New Application and fill in Application Name, Business Unit, Artifact Types and Application Description. You become the application owner. Select Save & Proceed.
In Team Detail, select Create Team, name the team, and add the users who will sign.
Select Add Mapping, choose the certificate and the team, then select Finish.
Note: A certificate appears in the mapping list only when it has an environment. If it is missing, right-click it in Keys and Certificates and select Edit Environment.
Build machines authenticate with an authentication certificate. Go to System Setup > User > Generate Authentication Certificate, select the user, enter a Certificate Name and a Valid Till date, then download the certificate file and keep its password. See Client Authentication for how these credentials work together.
Go to Signing Tools, filter by Windows and download the Encryption Consulting KSP.
Run the installer. When asked for API User Authentication Info, enter the Username, the Code (the CodeSign Secure activation code set during setup; your CodeSign Secure administrator can provide it), Identity Type 1 and the API Base URL https://<your domain>/api/.
In Registry Editor, open Computer\HKEY_CURRENT_USER\Software\Encryption Consulting\SigningKSP and set ectoken to the token generated in CodeSign Secure. The installer settings (Username, Code, Identity Type, and API Base URL) are stored in the same key, so you can change them there later.
Set the environment variables that point the KSP to your authentication certificate, then open a new command prompt:
setx EC_Client_Auth "C:\EC\AuthCert.pfx"
setx EC_Client_Pass "<certificate password>"
The complete procedure, including the registry value and Windows SDK, is in Windows Signing - SignTool.
In Keys and Certificates, right-click your certificate and select Download Certificate. Then run SignTool:
signtool sign /csp "Encryption Consulting Key Storage Provider" /kc <key name> /fd SHA256 /f <certificate file> /tr http://timestamp.digicert.com /td SHA256 <file to sign>
| Option | Value |
|---|---|
| /csp | Always "Encryption Consulting Key Storage Provider", typed exactly as shown |
| /kc | The key name of the certificate’s private key, for example evcodesigning |
| /f | The certificate file you downloaded in this step |
| /tr and /td | RFC 3161 timestamp server and digest. See Timestamping. |
If the certificate’s environment uses Certificate Owner or Quorum, the request appears on the Signing Request page. An approver must select Approve within 100 seconds, after entering the emailed MFA code if the environment requires MFA. See Approval Workflows.
signtool verify /pa /v setup.exe
The output shows the signing certificate and, if you timestamped, the timestamp. A self-signed certificate is not trusted by Windows, so verification reports an untrusted root unless the certificate chain is installed on the machine. This is expected for test certificates.
Go to Reports > Audit Trail and filter on the Crypto Operations category to see who signed, with which certificate and when. The Signing Request Report shows the request and its approval outcome.
Automate signing in a pipeline: CI/CD Integration and Securing CI/CD credentials.
Sign other formats: Supported formats and platforms.
Lock down the deployment: Security hardening checklist.