Navigation
The remote code signing service offers multiple clients, system providers, development interfaces, and automation integration methods.
If you are unsure which method to choose, you can start from the following based on your use case.
How to Choose an Integration Method
| Use Case | Recommended Method |
|---|---|
| Use the official command-line tool to directly sign EXE, DLL, MSI, and other files | Client Tool |
| Install the code signing client on macOS via Homebrew | Client Tool |
| Windows tools such as Microsoft SignTool, Visual Studio, and MSBuild need to use remote private keys directly | Windows Provider |
| Need compatibility with traditional Windows CryptoAPI / CSP applications | Windows Provider |
Use jarsigner to sign Java JAR files | Java Integration |
| Automate code signing in GitHub Actions | CI/CD and Build Tools |
| Use Electron Builder to automatically sign Windows applications | CI/CD and Build Tools |
| Using Advanced Installer to build and sign installation packages | CI/CD and build tools |
| Developing your own client or directly calling the remote signing service | API integration |
| Querying public information such as signature quota and timestamp servers | Reference |
Client tools
Suitable for users who want to use the official sslTrus client directly for code signing.
Key features include:
- SignTool CLI: sign files directly from the command line.
- Signature quota query: view the remaining and total certificate signing counts.
- Client update: check for and install the latest version.
- Homebrew: install the CLI or desktop client on macOS.
Windows Provider
Suitable for Microsoft SignTool, Visual Studio, MSBuild, installation package tools, and other software that supports the Windows Cryptography API.
Two providers are available:
- KSP (Key Storage Provider): based on Windows CNG, suitable for modern Windows signing workflows.
- CSP (Cryptographic Service Provider): based on the legacy CryptoAPI, suitable for applications that require CSP compatibility.
The signing private key is always stored in the cloud HSM, while the local provider is responsible for sending signing requests to the remote code signing service.
Java integration
Suitable for Java code signing scenarios.
With the Java Provider provided by sslTrus, you can use the standard jarsigner tool to perform remote code signing for JAR files.
CI/CD and build tools
Suitable for scenarios where code signing needs to be integrated into automated build, release, or packaging processes.
Currently includes:
- GitHub Actions
- Electron Builder
- Advanced Installer
Integration methods for other CI/CD or build tools will also be provided on this page.
API integration
Suitable for developers who need to build their own code signing client or integrate remote signing capabilities into existing systems.
The remote code signing API supports:
- Submitting a digest to be signed and receiving the signing result.
- Reporting the client's final signing status.
The caller is responsible for computing the file digest locally, handling the signing structure, and writing the final signing result.
Reference Materials
Common reference information applicable to various integration methods is provided here, including:
- Signature Count Calculation Guide: Explains how signature counts are calculated for scenarios such as CLI, KSP, CSP, Jarsigner, Electron, and installation packages.
- Timestamp Servers: Introduces Authenticode, RFC 3161, and commonly used code signing timestamp services.