Work through this checklist after installation and review it at least once a year.
Use a dedicated Windows Server 2022 machine for CodeSign Secure. Don’t run other applications on it.
Apply Windows security updates on a regular schedule, inside a maintenance window.
Limit local Administrator access to the people who run the platform, and use named accounts rather than shared ones.
Run endpoint protection that is approved for servers.
Allow inbound HTTPS on TCP 443, or on the HTTPS port you configured instead, such as 8443. See Ports and Protocols.
Keep MongoDB and the internal service ports unreachable from other machines.
Put the server and HSM on a restricted network segment. Allow only the build machines and administrator networks that need access.
Don’t let proxies inspect TLS traffic to CodeSign Secure, because inspection breaks client certificate authentication.
Replace the initial self-signed portal certificate with one from your PKI in SSL/TLS Management. Set the common name and SAN attributes to the portal DNS name.
Import the certificate and the full chain so that browsers and client tools can validate it.
Track the portal certificate’s expiry date. Before it expires, generate a new CSR and import the new certificate. Renewal in SSL/TLS Management applies only to the self-signed certificate provided with CodeSign Secure.
On a single server, keep MongoDB bound to the local machine.
In a cluster, enable MongoDB authentication and TLS between database members, and allow database traffic only between the CodeSign Secure servers and the database members.
Protect backup files as carefully as the database, because they contain a full dump. See What a backup contains.
Use a FIPS 140-2 Level 3 HSM and keep its firmware at the version listed in Supported HSMs.
Restrict HSM client access to the CodeSign Secure servers.
Keep HSM administrator cards and credentials under dual control.
Back up the HSM and test the restore. See Back up HSM keys.
Keep at least two named System Admins, and give that role only to people who administer the platform.
Grant other roles only the permissions they need. Roles start with no permissions. See Roles and Permissions.
Separate duties: the people who request production signatures shouldn’t be the only people who can approve them.
Use Quorum with MFA for production environments. See Designing signing policies.
Use Azure AD sign-in where possible, so account disabling and password policy follow your directory.
Lock accounts immediately when people leave, and review users and role assignments every quarter.
Issue a separate authentication certificate and API user for each pipeline or build machine, so you can revoke one without affecting others.
Set a short Valid Till date on authentication certificates and short API key expiries (30, 60 or 90 days), and renew them on a schedule.
Never commit PFX files, passwords, passcodes or ec_pkcs11client.ini to source control.
Restrict file permissions on PFX and INI files to the build service account. See Protect credentials on build machines.
Store CI secrets in your CI system’s secret store. See Securing CI/CD credentials.
Don’t type passwords on command lines where they are saved in shell history or CI logs.
Don’t publish screenshots or logs that show passwords, passcodes, client secrets or tokens.
Export logs to your SIEM with a plugin, or download and review them regularly.
Review the Audit Trail for unexpected signing, user changes and settings changes.
Set expiry triggers on every signing certificate. See Monitor expiry.
Check HSM Health Check on the Dashboard as part of daily operations.
Support packages contain diagnostic logs. Share them only with Encryption Consulting support through an approved channel, and delete old packages from Profile > Maintenance.
Restarting or shutting down from Profile > Maintenance stops signing immediately. Schedule it and notify users first.