Documentation | CodeSign Secure

Keys and security

Does the private key ever leave the HSM?

No. Keys are generated and used inside the HSM. Downloading a certificate gives you only the public certificate.

Is my file uploaded to the server?

No. With the Windows KSP, EC KSP for Mac and PKCS#11 Wrapper, the client machine calculates the hash locally and sends only the hash.

Signing and approvals

Can I sign in a fully automated pipeline?

Yes. Use a certificate in an environment with the No Approval policy. See Designing signing policies.

What happens if nobody approves a request?

It times out after 100 seconds, and the signing command fails.

Who can approve signing requests?

The certificate owner or quorum members, depending on the policy. Approvers must hold the System Admin or Project Manager role.

Which timestamp server should I use?

Use a public RFC 3161 TSA such as DigiCert or Sectigo, ideally the one run by the CA that issued your certificate. See Timestamping.

Administration

Why can’t a new user do anything?

Every role except System Admin starts with no permissions. A System Admin must enable them in Roles and Permissions.

Which sign-in methods are supported?

Azure AD (Microsoft Entra ID) and local accounts with an email and password registered by a System Admin.

Why was I signed out?

Each account can have one active session. Signing in again revokes the earlier sessions.

What does Signing KSPs Utilized count?

The number of KSP clients in use against the number your license allows. The Client Report shows which clients are in use. To extend the allowed count, contact Encryption Consulting support.

Why can’t I choose a certificate when mapping a team?

Only certificates with an environment are listed. Set one with Edit Environment in Keys and Certificates.

Frequently Asked Questions