SignTool Command Line Tool Usage Guide
SignTool is the command line client for the sslTrus remote code signing service, used to perform code signing operations in terminals or automation scripts.
Quick Start
The following is a basic example of a signing command. You can copy it and modify it according to the comments before use:
# 视情况而定，是否需要开启调试模式
#export DEBUG=1
# 使用环境变量配置 AK、SK 以及证书订阅号
export SIGNTOOL_ACCESS_KEY='' SIGNTOOL_ACCESS_SECRET='' SIGNTOOL_CERT_CODE=''
# 签名
./signtool sign \
--dry-run \
--access-key=$SIGNTOOL_ACCESS_KEY \
--access-secret=$SIGNTOOL_ACCESS_SECRET \
--cert-code=$SIGNTOOL_CERT_CODE \
--file=app-unsigned.exe \
--out=app.exe \
--sha1=false \
--sha2=true \
--timestamp-rfc3161 http://timestamp.acs.microsoft.com
Command Details
Before you start, you need to prepare the following three pieces of information:
View Help
Use the -h or --help parameter to view the complete command help.
./signtool sign -h
Core Parameter Reference
| Parameter | Abbreviation | Required | Description and Examples |
|---|---|---|---|
| --access-key | -k | Yes | API access key. Can also be set via the SIGNTOOL_ACCESS_KEY environment variable. |
| --access-secret | -s | Yes | API access secret. Can also be set via the SIGNTOOL_ACCESS_SECRET environment variable. |
| --cert-code | -c | Yes | The subscription ID of the remote code signing service, used to specify the signing certificate and for billing. |
| --file | -f | Yes | Path to the file to be signed. Example: -f "app.dll". |
| --out | -o | No | Path for the output file. By default, .signed is appended to the original filename. Important: If the file already exists, the operation will fail. |
| --override | No | Whether to overwrite the file at the original path. Default is false. | |
| --sha1 | -1 | No | Enable signing with the SHA1 algorithm (for legacy system compatibility). |
| --sha2 | -2 | No | Enable signing with the SHA256 algorithm (modern standard, recommended). |
| --nest | No | Whether to use nested signing. When the file already has an existing signature, --nest=true (default) will preserve the original signature and add a new one; false will remove the old signature. The effect comparison is shown below:  | |
| --timestamp | No | URL of the timestamp server for SHA1 signatures. Set to an empty string "" to disable. | |
| --timestamp-rfc3161 | No | URL of the RFC 3161 timestamp server for SHA256 signatures. Set to an empty string "" to disable. | |
| --desc | -n | No | Program description information. This information is embedded in the signature and may be displayed in system security prompts as shown below:  |
| --url | -u | No | Official information link for the program. |
| --verify | No | Immediately verify whether the file signature is valid after signing. | |
| --dry-run | No | Trial mode. In this mode, a self-signed certificate is used to test the signing process; you can fill in any value for the corresponding access key and subscription ID. |
About Boolean Parameters
For parameters that accept true/false values (such as --sha1, --nest), you must use the parameter=value format; space-separated syntax is not supported.
- Correct: --sha1=true --sha2=false
- Incorrect: --sha1 true --sha2 false