signtool ksp and Windows KSP Integration

signtool ksp manages Windows sslTrus Key Storage Provider (KSP). Once the KSP is installed and configured, Microsoft signtool.exe can invoke the remote signing service through the CNG Provider without holding the private key locally.

Note

All signtool ksp subcommands are only supported on the Windows platform. Executing any ksp subcommand on a non-Windows platform will return: key storage provider is only supported on windows

---

Subcommand Overview

signtool ksp [command]

Subcommand	Purpose
install	Install and register the KSP DLL
uninstall	Unregister the KSP and delete the DLL
list	List saved KSP key configurations
add	Add a new KSP key configuration (interactive)
del	Delete a specified KSP key configuration (interactive)

Note

The --address parameter is only valid with ksp add and is used to fetch the certificate PEM and save the remote service address.

---

Installing KSP

signtool ksp install

After execution:

1. Write the embedded sslTrusKSP.dll to ProgramData/sslTrusKSP/sslTrusKSP.dll.
2. If the DLL version in ProgramData differs from that in System32, copy the DLL to System32.
3. Register the CNG Provider: sslTrus Key Storage Provider.
4. Save the KSP configuration file ProgramData/sslTrusKSP/config.dat (encrypted with DPAPI).

Note

install modifies the system-level CNG Provider registry. It is recommended to run it in an administrator terminal. If the DLL versions are detected to be identical, it will log ksp is already installed and return directly.

---

Uninstall KSP

signtool ksp uninstall

After execution:

1. Unregister the CNG Provider: sslTrus Key Storage Provider.
2. Delete ProgramData/sslTrusKSP/sslTrusKSP.dll.
3. Delete sslTrusKSP.dll in System32.

Note

uninstall does not delete the entire ProgramData/sslTrusKSP directory. The saved config.dat, certificate files, and logs need to be cleaned up manually.

---

View Key Configuration

signtool ksp list

Output field description:

Field	Description
No	Serial number
CertCode	Certificate number
ServerUrl	Displayed as nicsrs or default
AccessKey	Access Key
AccessSecret	Masked Access Secret

Note

• If there is no configuration file, return no ksp configuration.

• If the configuration exists but the key list is empty, record no ksp key.
• AccessSecret is displayed masked, but the configuration file itself should still be managed as a sensitive file. :::

---

Add Key Configuration

signtool ksp add

Specify the NICSRS address:

signtool ksp add --address nicsrs

The command is interactive, enter the inputs in sequence:

Please enter the access key: your-access-key
Please enter the access secret: your-access-secret
Please enter the certificate code: CERT_CODE

After execution:

1. Call the remote /v1/codesign/cert to obtain the certificate PEM.
2. Save the certificate as ProgramData/sslTrusKSP/CERT_CODE.crt.
3. Write the key configuration to ProgramData/sslTrusKSP/config.dat (encrypted with DPAPI).

If the certificate number already exists, a prompt will appear:

The certificate code already exists, do you want to override it? [y/N]

Enter y to overwrite; any other value or pressing Enter directly will discard.

Note

ksp add is an interactive command and currently does not support non-interactive parameters such as --access-key and --cert-code. Adding configuration accesses the remote API and writes the certificate PEM to the local ProgramData.

---

Delete Key Configuration

signtool ksp del

Interactive certificate number input:

Please enter the certificate code: CERT_CODE

After execution, delete the matching key configuration from config.dat, and re-save the encrypted configuration file.

Note

The current implementation only deletes configuration items, not the ProgramData/sslTrusKSP/CERT_CODE.crt certificate file.

---

Using Microsoft signtool.exe via KSP

After KSP configuration is complete, use Microsoft signtool.exe from the Windows SDK to call the Provider.

Note

signtool.exe in the following command is a tool bundled with Microsoft Windows SDK, not the sslTrus CLI. If both exist in the current directory or PATH, use the full path to signtool.exe from the Windows SDK to avoid confusion.

SHA256 signature example:

signtool.exe sign /v ^
  /csp "sslTrus Key Storage Provider" ^
  /kc CERT_CODE ^
  /f C:\ProgramData\sslTrusKSP\CERT_CODE.crt ^
  /fd SHA256 ^
  /tr http://timestamp.acs.microsoft.com ^
  /td SHA256 ^
  .\EXAMPLE.exe

Appending a SHA1 Signature Example:

signtool.exe sign /v ^
  /csp "sslTrus Key Storage Provider" ^
  /kc CERT_CODE ^
  /f C:\ProgramData\sslTrusKSP\CERT_CODE.crt ^
  /fd SHA1 ^
  /tr http://timestamp.acs.microsoft.com ^
  /td SHA256 ^
  /as ^
  .\EXAMPLE.exe

Parameter Description:

Parameter	Meaning
/csp "sslTrus Key Storage Provider"	Specifies the KSP Provider for the sslTrus installation
/kc CERT_CODE	Specifies the KSP key name, conventionally set to the certificate number
/f C:\ProgramData\sslTrusKSP\CERT_CODE.crt	Specifies the certificate file saved by ksp add
/fd SHA256 or /fd SHA1	File digest algorithm
/tr <url>	RFC3161 timestamp service
/td SHA256	Timestamp digest algorithm
/as	Append signature without overwriting the existing signature

---

Troubleshooting Reference

Error Message	Possible Cause	Recommended Action
key storage provider is only supported on windows	The ksp command was executed on a non-Windows platform.	Only run KSP operations on Windows.
no ksp configuration	The KSP configuration file has not been created yet.	Run signtool ksp install and signtool ksp add first.
no such certificate code	The certificate number to be deleted does not exist.	Use signtool ksp list to confirm the certificate number.

---

Security Notes

• signtool ksp install and signtool ksp uninstall will modify the Windows system directory and CNG Provider registry, typically requiring administrator privileges.
• signtool ksp add will access the remote certificate interface and write the certificate file and encrypted configuration to ProgramData/sslTrusKSP.
• Access Secret, KSP configuration files, and local logs should all be treated as sensitive information and must not be written to logs or version control repositories.