signtool sign Command Reference

Note

The signtool referenced in this article refers to the sslTrus Remote Code Signing Client CLI, not the signtool.exe that comes with the Microsoft Windows SDK. When referring to Windows SDK tools, it will be explicitly written as Microsoft signtool.exe.

signtool sign directly performs remote signing on local files. The CLI extracts the data to be signed locally, calls the remote service to complete private key signing, and then writes the signature, timestamp, and certificate information back to the output file.

signtool sign [flags]

View help and version information:

signtool --help
signtool --version

Credential Configuration

sign The command reads access credentials in the following ways:

Credential Item	Parameter	Environment Variable	Description
Access Key	--access-key / -k	ACCESS_KEY	Automatically reads the environment variable when the parameter is empty
Access Secret	--access-secret / -s	ACCESS_SECRET	Automatically reads the environment variable when the parameter is empty

export ACCESS_KEY="your-access-key"
export ACCESS_SECRET="your-access-secret"

The remote service address is controlled by the --address parameter and supports the following values:

Parameter value	Actual service address
nicsrs	https://ssl.face.nicsrs.com
Empty value, racent or any other value	https://ssl.face.racent.com

Note

• ACCESS_KEY and ACCESS_SECRET are the actual environment variable names that will be read; SIGNTOOL_ACCESS_KEY / SIGNTOOL_ACCESS_SECRET will not be automatically read by the current CLI.
• It is not recommended to write the Access Secret into shell history or script repositories. Prefer runtime-injected environment variables or secure CI variables.

---

Parameter Reference

Parameter	Shorthand	Default Value	Description
--address	-a	Empty	Remote service address identifier, not a pass-through URL parameter.
--access-key	-k	Empty	When empty, read ACCESS_KEY.
--access-secret	-s	Empty	When empty, read ACCESS_SECRET.
--cert-code	-c	Empty	Required. Certificate number.
--file	-f	Empty	Required. Path of the file to be signed; cannot be a directory.
--out	-o	Empty	Output file path; if left empty and overwrite is not enabled, a default filename will be generated automatically.
--override	—	false	Overwrite the original file with the output file.
--sha1	-1	false	Enable SHA1 signature.
--sha2	-2	true	Enable SHA2 signature.
--timestamp	—	auto	SHA1 Authenticode timestamp address. auto uses the default address; an empty string disables it.
--timestamp-rfc3161	—	auto	SHA2 RFC3161 timestamp address. auto uses the default address; an empty string disables it.
--desc	-n	Empty	Program description text written into the signature.
--url	-u	Empty	The program information URL to be written into the signature.
--nest	—	true	Preserve the existing signature and append a nested signature; existing signatures will be cleared when false.
--verify	—	false	Return an error if the certificate is not trusted when appending the signature.
--dry-run	—	false	Generates a signature using a local test certificate without calling the remote signature interface.

Boolean parameter format

Boolean parameters must use the 参数=值 format, and space-separated values are not supported:

• Correct: --sha1=true --sha2=false
• Incorrect: --sha1 true --sha2 false

Mandatory rules

The following conditions are validated before execution; if any condition is not met, the program will report an error and exit:

• Either --access-key or ACCESS_KEY must be present.
• --access-secret or ACCESS_SECRET must exist.
• --cert-code must exist.
• --file must exist and cannot be a directory.
• At least one of --sha1 and --sha2 must be enabled.

---

Output file rules

When --out is not specified:

--override	Output behavior
false (Default)	Output to the same directory as the input file, with the file name ${name}.signed.${yyyyMMdd.HHmmss}${ext}
true	Overwrite the input file directly

Example:

app.exe    → app.signed.20260611.153000.exe
driver.sys → driver.signed.20260611.153000.sys

Note

--override=true will overwrite the original file. Please confirm you have created a backup before execution. When signing fails, the CLI will make a best-effort attempt to delete incomplete output files.

---

Algorithm selection

Only SHA2 is enabled by default:

signtool sign -c CERT_CODE -f app.exe

Sign with SHA1 only:

signtool sign -c CERT_CODE -f app.exe --sha1=true --sha2=false

Sign SHA1 and SHA2 simultaneously:

signtool sign -c CERT_CODE -f app.exe --sha1=true --sha2=true

Note

When SHA1 and SHA2 are both enabled, the process handles SHA1 first before processing SHA2. SHA1 is still supported at present, but SHA2 is preferred for new signing scenarios.

---

Timestamp configuration

The auto values for --timestamp and --timestamp-rfc3161 will be replaced with the default addresses during the verification phase:

Parameter	Actual value of auto	Purpose
--timestamp	http://timestamp.sectigo.com	SHA1 Authenticode timestamp
--timestamp-rfc3161	http://timestamp.sectigo.com	SHA2 RFC3161 timestamp

Customize the SHA2 timestamp service:

signtool sign \
  -c CERT_CODE \
  -f app.exe \
  --timestamp-rfc3161=http://timestamp.acs.microsoft.com

Disable SHA2 timestamp:

signtool sign -c CERT_CODE -f app.exe --timestamp-rfc3161=

Disable all timestamps:

signtool sign -c CERT_CODE -f app.exe --timestamp= --timestamp-rfc3161=

Note

• Only timestamp addresses starting with http will be used.
• --timestamp is preferred for SHA1; if it is not an HTTP address, the CLI will attempt to use --timestamp-rfc3161 instead.
• --timestamp-rfc3161 is used for SHA2.
• If adding a timestamp fails for SHA2, the CLI will automatically retry once between the default Microsoft and Sectigo addresses.
• A timestamp failure does not necessarily cause the signature to fail; the CLI will log the error and retain the untimestamped signature result.

---

Common Examples

Provide credentials via environment variables, use SHA2 signature by default:

export ACCESS_KEY="your-access-key"
export ACCESS_SECRET="your-access-secret"

signtool sign \
  --cert-code CERT_CODE \
  --file app-unsigned.exe \
  --out app-signed.exe

Provide credentials directly using parameters:

signtool sign \
  --access-key "your-access-key" \
  --access-secret "your-access-secret" \
  --cert-code CERT_CODE \
  --file app-unsigned.exe \
  --out app-signed.exe

Use the NICSRS address:

signtool sign \
  --address nicsrs \
  --cert-code CERT_CODE \
  --file app-unsigned.exe \
  --out app-signed.exe

Enter the program description and official website URL:

signtool sign \
  -c CERT_CODE \
  -f app-unsigned.exe \
  -o app-signed.exe \
  --desc "Example Application" \
  --url "https://example.com"

Append nested signature (retain existing signatures):

signtool sign -c CERT_CODE -f app.exe --nest=true

Overwrite original file:

signtool sign -c CERT_CODE -f app.exe --override=true

dry-run Local trial signing (does not call remote interfaces):

signtool sign \
  -k dummy \
  -s dummy \
  -c CERT_CODE \
  -f app.exe \
  --dry-run=true

Note

--dry-run does not call the remote signing interface, but it still reads and writes local files and invokes local self-signed certificates. Currently, non-null validation for credentials and certificate serial numbers still applies, so placeholder credentials are used in the example.

---

Troubleshooting Reference

Error Message	Possible Cause	Recommended Action
access key is required...	Neither --access-key is passed nor ACCESS_KEY is configured.	Set the environment variable or use -k.
access secret is required...	--access-secret was not provided, and ACCESS_SECRET was not set either.	Set the environment variable or use -s.
cert code is required...	The certificate ID was not provided.	Use -c CERT_CODE.
sha1 or sha2 is required...	Both SHA1 and SHA2 are disabled.	Enable at least one algorithm.
file <path> is a directory	--file points to a directory instead of a file.	Change to the path of the file to be signed.
Timestamp failed but the signature file was generated	The timestamp service is unavailable or certificate chain validation failed.	Check the timestamp URL and replace --timestamp-rfc3161 if necessary.