signtool ksp Integration with Windows KSP

signtool ksp manages Windows sslTrus Key Storage Provider (KSP). After the KSP is installed and configured, Microsoft signtool.exe can call the remote signing service through the CNG Provider without holding the private key locally.

Note

All subcommands of signtool ksp are only supported on the Windows platform. Executing any ksp subcommand on a non-Windows platform will return: key storage provider is only supported on windows

---

Subcommand Overview

signtool ksp [command]

Subcommand	Purpose
install	Install and register the KSP DLL
uninstall	Unregister the KSP and remove the DLL
list	List saved KSP key configurations
add	Add a new KSP key configuration (interactive)
del	Delete the specified KSP key configuration (interactive)

Note

The --address parameter is only valid when ksp add, and is used to retrieve the certificate PEM and save the remote service address.

---

Install KSP

signtool ksp install

After execution:

1. Write the embedded sslTrusKSP.dll to ProgramData/sslTrusKSP/sslTrusKSP.dll.
2. If the DLL version in ProgramData is different from the one in System32, copy the DLL to System32.
3. Register the CNG Provider: sslTrus Key Storage Provider.
4. Save the KSP configuration file ProgramData/sslTrusKSP/config.dat (DPAPI encrypted).

Note

install will modify the system-level CNG Provider registration. It is recommended to run it in an administrator terminal. If the DLL versions are detected to be the same, it will log ksp is already installed and return directly.

---

Uninstall KSP

signtool ksp uninstall

After execution:

1. Unregister the CNG Provider: sslTrus Key Storage Provider.
2. Delete ProgramData/sslTrusKSP/sslTrusKSP.dll.
3. Delete sslTrusKSP.dll in System32.

Note

uninstall will not delete the entire ProgramData/sslTrusKSP directory. Saved config.dat, certificate files, and logs need to be cleaned up manually.

---

View Key Configuration

signtool ksp list

Output Field Description:

Field	Description
No	Serial number
CertCode	Certificate ID
ServerUrl	Displayed as nicsrs or default
AccessKey	Access Key
AccessSecret	Masked Access Secret

Description

• If there is no configuration file, return no ksp configuration.
• If the configuration exists but the key list is empty, record no ksp key.
• AccessSecret will be displayed in a masked format, but the configuration file itself must still be managed as a sensitive file.

---

Add Key Configuration

signtool ksp add

Specify the NICSRS address:

signtool ksp add --address nicsrs

This command runs in interactive mode; enter the following items in sequence:

Please enter the access key: your-access-key
Please enter the access secret: your-access-secret
Please enter the certificate code: CERT_CODE

After execution:

1. Call the remote /v1/codesign/cert to obtain the certificate PEM.
2. Save the certificate as ProgramData/sslTrusKSP/CERT_CODE.crt.
3. Write the key configuration to ProgramData/sslTrusKSP/config.dat (DPAPI encryption).

If the certificate ID already exists, the following prompt will appear:

The certificate code already exists, do you want to override it? [y/N]

Enter y to overwrite; enter any other value or press Enter directly to cancel.

Notice

ksp add is an interactive command. Non-interactive parameters such as --access-key and --cert-code are currently not supported. Adding a configuration will access the remote API and write the certificate PEM to the local ProgramData directory.

---

Delete Key Configuration

signtool ksp del

Interactively enter the certificate ID:

Please enter the certificate code: CERT_CODE

After execution, the matched key configuration will be deleted from config.dat, and the encrypted configuration file will be saved again.

Note

The current implementation only deletes the configuration entry, and does not delete the ProgramData/sslTrusKSP/CERT_CODE.crt certificate file.

---

Use Microsoft signtool.exe via KSP

After KSP configuration is complete, use the Microsoft signtool.exe from the Windows SDK to call the Provider.

Warning

The signtool.exe in the following command is a tool that comes with Microsoft Windows SDK, not the sslTrus CLI. If both exist in the current directory or PATH, use the full path to signtool.exe in the Windows SDK to avoid confusion.

SHA256 signing example:

signtool.exe sign /v ^
  /csp "sslTrus Key Storage Provider" ^
  /kc CERT_CODE ^
  /f C:\ProgramData\sslTrusKSP\CERT_CODE.crt ^
  /fd SHA256 ^
  /tr http://timestamp.acs.microsoft.com ^
  /td SHA256 ^
  .\EXAMPLE.exe

Example of appending an SHA1 signature:

signtool.exe sign /v ^
  /csp "sslTrus Key Storage Provider" ^
  /kc CERT_CODE ^
  /f C:\ProgramData\sslTrusKSP\CERT_CODE.crt ^
  /fd SHA1 ^
  /tr http://timestamp.acs.microsoft.com ^
  /td SHA256 ^
  /as ^
  .\EXAMPLE.exe

Parameter description:

Parameter	Description
/csp "sslTrus Key Storage Provider"	Specifies the KSP Provider installed by sslTrus
/kc CERT_CODE	Specifies the KSP key name, which is conventionally the certificate serial number
/f C:\ProgramData\sslTrusKSP\CERT_CODE.crt	Specifies the certificate file saved by ksp add
/fd SHA256 or /fd SHA1	File digest algorithm
/tr <url>	RFC3161 timestamp service
/td SHA256	Timestamp digest algorithm
/as	Append a signature without overwriting existing signatures

---

Troubleshooting Reference

Error message	Possible cause	Recommended action
key storage provider is only supported on windows	The ksp command was executed on a non-Windows platform.	Only perform KSP operations on Windows.
no ksp configuration	The KSP configuration file has not been created yet.	Execute signtool ksp install and signtool ksp add first.
no such certificate code	The certificate ID you are trying to delete does not exist.	Use signtool ksp list to confirm the certificate ID.

---

Security Notes

• signtool ksp install and signtool ksp uninstall modify the Windows system directory and CNG Provider registration, which typically require administrator privileges.
• signtool ksp add accesses the remote certificate interface and writes certificate files and encryption configurations to ProgramData/sslTrusKSP.
• Access Secret, KSP configuration files, and local logs should all be treated as sensitive information and must not be written to logs or version control repositories.