CodeSign Secure Documentation
  • Overview
    • About CodeSign Secure
    • Getting Started
    • Documentation Guide
    • Portal Overview
    • Troubleshooting
      • FAQ
    • Glossary
  • Reference Guide
    • Header Bar
      • CodeSign Secure Documentation
      • Swagger API
      • Profile Section
    • Dashboard
      • Key Performance Indicators
      • Issued Certificates
      • Signatures Generated
      • HSM Health Check
    • Keys and Certificates
      • Key and Certificate Lifecycle
    • App Management
    • Signing Requests
      • Approval Workflows
    • Signing Tools
    • Reports
      • Signing Request Report
      • Audit Trail
      • Certificate Report
      • Client Report
    • Logs
    • System Setup
      • Identity Store
      • Backup
      • User
      • Roles and Permissions
      • Email
      • Signing Projects
      • SSL/TLS Management
      • Environment
      • Plugins
  • Setup & Architecture
    • Identity and Access Control
    • Architecture and Concepts
    • Installation
      • Windows
        • Installing the Server
        • Ports and Protocols
        • High Availability and Backup
        • Upgrades and Compatibility
    • Security
      • Security Hardening Checklist
      • Client Authentication
      • Designing Signing Policies
  • Release Notes
    • Releases for 2026
      • v3.2.1
    • Releases for 2025
      • v3.2.0
    • Releases for 2024
      • v3.1.0
  • API Reference
    • Getting Started
    • Authorizing Requests
    • Securing API Access
    • Request and Response Conventions
    • Endpoint Reference
      • Signing
      • Signing Requests
      • Certificates
      • Applications and Environments
      • User Management
      • Permissions
      • Email
      • System Setup
      • Reports
      • Dashboard
      • License
  • Integration Guides
    • Signing Capabilities
      • Supported Formats and Platforms
      • Timestamping
      • Windows Signing - SignTool
        • Signing
        • Macro Signing
      • Apple Signing
      • AppX & MSIX Signing
      • Visual Studio ClickOnce
      • Jar Signing
      • Sign HLK/HCK using CodeSign Secure
      • NuGet Signing
      • Mage Signing
      • Sign OVA/OVF using Encryption Consulting’s Utility Tool
      • Utility Tool for code signing
      • Container Signing
      • PKCS11 Wrapper
        • APK Signing
        • OpenSSL Signing
        • XML Signing
        • JSign Tool Signing
        • Jarsigner Signing
        • GPG2, Debian & RPM Signing
      • Reproducible Build
        • Automated Hash Validation
        • Reproducible Build Process Flow
        • Pipeline Script Components
        • Hash Validation
    • CI/CD Integration
      • GitHub Actions
      • Jenkins
      • GitLab
      • Azure DevOps
      • TeamCity
      • Bamboo
      • Securing CI/CD Credentials

Windows Signing - Signtool

Our Windows Signing tool can sign all types of Windows files including .exe, .dll, .sys, and more.

Windows Configuration

To install the client tools:

  • Sign in to CodeSign Secure
  • Navigate to: Signing tools repository.

    Signing tools repository
  • Download "Encryption Consulting CNG-SigningKSP".
  • Install the client tools using the .MSI installer. The .MSI installer automates much of the configuration. Navigate to where the downloaded file is saved and launch the installer.

    client tools
  • Click next when the installation wizard appears.

    KSP
  • Click next.

    KSP Signing
  • In the Username field, type registered username.
  • In the Code field, enter the CodeSign Secure activation code that was set during setup. Your CodeSign Secure administrator can provide it.

  • Change the Identity Type to 1.
  • Leave API BaseURL the same.
  • Click next.

    CodeSignSecure API Auth
  • Click next.

    Signing Installation
  • You will then be notified that this program will make changes to your pc, click yes.

    Code Signing
  • Installation is now complete

    Signing Installation
  • After installing the KSP, we need to update the Environment Variables

    1. Click on Start menu and search for Environment Variables

      Edit Environment Vairable
    2. Click on Environment Variables

      Environment Vairable
    3. Add new system variables by clicking on New button. Provide the following variable name and there corresponding details.

      • EC_Client_Auth:Corresponds to the path of your SSL Authentication certificate which can be created from CodeSignSecure

        Generate Authentication Certificate
      • EC_Client_Pass: Corresponds to the password of your certificate which is provided at the time of creation of the certificate.

      • EC_SSL_VERBOSE: Corresponds to the setting to either enable (1) or disable (0) the debugging output for EC KSP.

        CodeSign Environment Variables
  • We also need add the “ectoken” in the Registry Editor

    1. Click on Start menu and search for “Registry Editor"

      Registry Editor
    2. Go to HKEY_CURRENT_USER -> Software -> Encryption Consulting -> SigningKSP

      Signing KSP Registry Location
    3. Get the ectoken from CodeSignSecure

      CodeSing Auth Token
    4. Update the field with the token generated from CodeSign Secure platform.

      Updating Registry

      Note: The full path is Computer\HKEY_CURRENT_USER\Software\Encryption Consulting\SigningKSP. The settings you entered in the installer (Username, Code, Identity Type, and API Base URL) are stored in the same key, so you can change them there without reinstalling. Because the key is under HKEY_CURRENT_USER, it applies only to the Windows account that ran the installer. If a build agent runs as another account, configure the same values for that account.

  • Using the following download link, download the Windows Software Development Kit with the following tools selected: developer.microsoft.com/en-us/windows/downloads/windows-10-sdk/

    Windows Software Development Kit
  • Open the installer once downloaded and select next on the first screen.

    windows installer
  • Select next

    Windows kit
  • Select Accept

    microsoft license
  • Deselect everything except "Windows SDK Signing Tools for Desktop Apps" and select install

    Desktop apps

Go to the following path where the tools should have downloaded to: C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64.

Ensure you are in the x64 directory, copy the directory path, and search environment variables in the bottom searchbar of your taskbar. The following window should appear when selecting environment variables:

x64 directory

Select Environment Variables at the bottom right. Scroll down through the system variables on the bottom table until you find PATH in the variable names.

Environment Variables

Double click on PATH in system variables and select new on the left of the screen. Paste your copied directory path into the new selection.

system variables path

Select OK at the bottom right of each page.

Note: For how the authentication certificate and API user credentials work together, see Client Authentication. For SignTool and KSP errors, see Troubleshooting.

On this Page:
Support Privacy Policy Terms of Service

Copyright Encryption Consulting LLC. All rights reserved.