CodeSign Secure Documentation
  • Overview
    • About CodeSign Secure
    • Getting Started
    • Documentation Guide
    • Portal Overview
    • Troubleshooting
      • FAQ
    • Glossary
  • Reference Guide
    • Header Bar
      • CodeSign Secure Documentation
      • Swagger API
      • Profile Section
    • Dashboard
      • Key Performance Indicators
      • Issued Certificates
      • Signatures Generated
      • HSM Health Check
    • Keys and Certificates
      • Key and Certificate Lifecycle
    • App Management
    • Signing Requests
      • Approval Workflows
    • Signing Tools
    • Reports
      • Signing Request Report
      • Audit Trail
      • Certificate Report
      • Client Report
    • Logs
    • System Setup
      • Identity Store
      • Backup
      • User
      • Roles and Permissions
      • Email
      • Signing Projects
      • SSL/TLS Management
      • Environment
      • Plugins
  • Setup & Architecture
    • Identity and Access Control
    • Architecture and Concepts
    • Installation
      • Windows
        • Installing the Server
        • Ports and Protocols
        • High Availability and Backup
        • Upgrades and Compatibility
    • Security
      • Security Hardening Checklist
      • Client Authentication
      • Designing Signing Policies
  • Release Notes
    • Releases for 2026
      • v3.2.1
    • Releases for 2025
      • v3.2.0
    • Releases for 2024
      • v3.1.0
  • API Reference
    • Getting Started
    • Authorizing Requests
    • Securing API Access
    • Request and Response Conventions
    • Endpoint Reference
      • Signing
      • Signing Requests
      • Certificates
      • Applications and Environments
      • User Management
      • Permissions
      • Email
      • System Setup
      • Reports
      • Dashboard
      • License
  • Integration Guides
    • Signing Capabilities
      • Supported Formats and Platforms
      • Timestamping
      • Windows Signing - SignTool
        • Signing
        • Macro Signing
      • Apple Signing
      • AppX & MSIX Signing
      • Visual Studio ClickOnce
      • Jar Signing
      • Sign HLK/HCK using CodeSign Secure
      • NuGet Signing
      • Mage Signing
      • Sign OVA/OVF using Encryption Consulting’s Utility Tool
      • Utility Tool for code signing
      • Container Signing
      • PKCS11 Wrapper
        • APK Signing
        • OpenSSL Signing
        • XML Signing
        • JSign Tool Signing
        • Jarsigner Signing
        • GPG2, Debian & RPM Signing
      • Reproducible Build
        • Automated Hash Validation
        • Reproducible Build Process Flow
        • Pipeline Script Components
        • Hash Validation
    • CI/CD Integration
      • GitHub Actions
      • Jenkins
      • GitLab
      • Azure DevOps
      • TeamCity
      • Bamboo
      • Securing CI/CD Credentials

Supported Formats and Platforms

Which file types CodeSign Secure can sign, with which tool and client, and on which operating systems.

Signing formats
Format or file typeSigning toolCodeSign Secure clientClient OS in the guideVerify withGuide
Authenticode: any file SignTool can sign, for example .exe, .dll, .sys, .msi, .cab, .cat, .ps1SignToolWindows KSPWindowssigntool verify /paSignTool signing
Office VBA macros, for example .xlsmSignTool with the Office VBA SIP installedWindows KSPWindowsOffice Trust Center or signtool verifyMacro Signing
AppX and MSIX packagesSignToolWindows KSPWindowssigntool verify /paAppX & MSIX
ClickOnce applicationsVisual Studio publishWindows KSP and ECGetCert.exeWindowsVisual Studio / MageVisual Studio ClickOnce
ClickOnce manifests (.application, .manifest)MageWindows KSPWindowsmage -VerifyMage Signing
NuGet packages (.nupkg)NuGet CLI or Utility ToolWindows KSPWindowsnuget verify -SignaturesNuGet Signing
JAR filesjarsigner with the Windows-MY keystoreWindows KSPWindowsjarsigner -verifyJar Signing
HLK/HCK packagesHLK Studio or custom utilityWindows KSPWindowsHLK StudioHLK/HCK Signing
OVA/OVF appliancesUtility ToolUtility ToolWindowsSee the guideOVA/OVF Signing
Files signed interactively, single or in bulkUtility ToolUtility ToolWindowsNative tool for the formatUtility Tool
Container imagescosignec-signerContainer build hostcosign verifyContainer Signing
Android APKapksignerPKCS#11 WrapperLinux, macOS, Windowsapksigner verifyAPK Signing
Raw signatures of any fileOpenSSLPKCS#11 WrapperLinux, Windowsopenssl dgst -verifyOpenSSL Signing
XML documentsXML signing toolPKCS#11 WrapperLinux, macOSSee the guideXML Signing
Authenticode from Java (.exe, .dll, .msi, .ps1 and more)JSignPKCS#11 WrapperLinux, macOS, Windowssigntool verify or PowerShellJSign Signing
JAR filesjarsignerPKCS#11 WrapperLinux, macOS, Windowsjarsigner -verifyJarsigner Signing
Detached GPG signatures, Debian packages, RPM packagesGnuPG, dpkg-sig, rpmPKCS#11 WrapperLinux (Ubuntu)gpg --verify, rpm -KGPG2, Debian & RPM
macOS apps and binariescodesignEC KSP for MacmacOScodesign --verifyApple Signing
Key algorithms
AlgorithmKey sizes or curves
RSA2048, 3072, 4096 bits
ECDSAP-256, P-384, P-521

The signing tool chooses the digest algorithm. The guides use SHA-256, for example SignTool /fd SHA256 and jarsigner -sigalg SHA256withRSA. With an ECDSA key, use the matching ECDSA algorithm name, for example SHA256withECDSA for jarsigner.

Supported HSMs
HSMFirmwareSoftwareNotes
Entrust nShield13.8.0 or later13.7.3 or laterFIPS 140-2 Level 3. High-availability configurations supported.
Thales Luna10.7.1-125 or later7.3.0 or laterFIPS 140-2 Level 3. High-availability configurations supported.
Securosys Primus HSM2.8.21 or laterPrimus PKCS#11 provider for your firmware versionFIPS 140-2 Level 3 (X- and E-Series on firmware 2.8.21). X2- and E2-Series run firmware 3.x.
Utimaco SecurityServer Se Gen24.32.0 or laterSecurityServer PKCS#11 client for your firmware versionFIPS 140-2 Level 3 (CryptoServer Se-Series Gen2 on firmware 4.32.0).

Use the listed versions or later. For other HSMs, contact Encryption Consulting before you deploy.

Server platform
ComponentRequirement
Operating systemWindows Server 2022
Python3.10.11 or later
MongoDB6.0 or later
DeploymentSingle server, or a cluster behind a load balancer
Client platforms
ClientOperating systems
Windows KSPWindows 10 and Windows 11 (tested)
EC KSP for MacmacOS
PKCS#11 WrapperWindows, Linux and macOS
Utility ToolWindows
ec-signerContainer build host with Python and Docker
Tool versions used in the guides

The guides were written with these third-party tool versions. Newer versions usually work, but these are the ones shown in the examples.

ToolVersion in the guides
Windows SDK (SignTool)10.0.26100.0
Java (for apksigner, jarsigner, JSign)JDK 8 on Linux, JDK 17 on macOS, JDK 22 on Windows in the APK guide; JDK 17 or 21 in other guides
Android build-tools (apksigner)34.0.0
JSign7.0
GnuPG2.5.4
cosign2.0.0
On this Page:
Support Privacy Policy Terms of Service

Copyright Encryption Consulting LLC. All rights reserved.