Designing Signing Policies
Choose approval policies for each environment so that production signing is controlled without slowing down development or automation.
Policy options
| Policy | What happens to a signing request | Who approves |
|---|
| Certificate Owner | Waits until the certificate owner approves or denies it | The owner of the certificate |
| Quorum | Waits until the required number of quorum members approve it | The users set as quorum members |
| No Approval | Is signed immediately | Nobody |
-
Approvers for Certificate Owner and Quorum must hold the System Admin or Project Manager role, or both.
-
An environment that shows No Policy Setup behaves as No Approval.
-
Needs MFA adds a one-time code, sent by email, that the approver must enter before Approve and Deny appear.
Timers
| Timer | Value | What it means |
|---|
| Request validity | 100 seconds | The request must be approved within 100 seconds of being submitted. Otherwise, it times out and the approval buttons disappear. |
| MFA validation | 15 minutes | An MFA validation stays valid for 15 minutes. |
How approvals affect pipelines
When a pipeline signs with a certificate whose environment needs approval, the signing job waits for the decision. If nobody approves within 100 seconds, the request times out and the signing command fails, which fails the job.
-
For fully automated signing, use a certificate in an environment with No Approval, and control risk through team mapping, dedicated API users and the Audit Trail.
-
For release signing that needs approval, make sure an approver is available when the release job runs, and tell them when it starts.
-
Use separate certificates for automated and approved signing, so that each keeps its own policy.
Recommended environments
| Environment | Policy | Needs MFA | Typical use |
|---|
| Dev | No Approval | Off | Developer and test builds, usually with self-signed certificates |
| CI | No Approval | Off | Automated builds that must never wait for a person |
| Staging | Certificate Owner | Optional | Release candidates reviewed by the application owner |
| Production | Quorum | On | Releases that customers install |
| EV / High assurance | Quorum, with a higher minimum | On | EV certificates, drivers and other high-impact artifacts |
Setting up a quorum
-
Choose Quorum as the Policy Type, then select the eligible approvers and the number of approvals required.
-
Choose more eligible approvers than the minimum, so one absence doesn’t block a release.
-
Only users with the System Admin or Project Manager role can be quorum members.
Policy checklist
-
Every production certificate is in an environment with Quorum or Certificate Owner, and MFA is on.
-
Automated pipelines use their own certificates in No Approval environments.
-
Approvers know the 100-second window and watch for signing request notifications.
-
The people who request production signatures are not the only people who can approve them.
-
You review environment assignments whenever you create or import a certificate.
