signtool sign command reference

Note

signtool in this article refers to the sslTrus remote code signing client CLI, not the signtool.exe included with the Microsoft Windows SDK. When a Windows SDK tool is being referenced, it will be explicitly written as Microsoft signtool.exe.

signtool sign performs remote signing directly on local files. The CLI extracts the data to be signed locally, invokes the remote service to complete the private key signature, and then writes the signature, timestamp, and certificate information back to the output file.

signtool sign [flags]

View help and version:

signtool --help
signtool --version

Credential Configuration

sign The command reads access credentials through the following methods:

Credential Item	Parameter	Environment Variable	Description
Access Key	--access-key / -k	ACCESS_KEY	Automatically reads the environment variable when the parameter is empty
Access Secret	--access-secret / -s	ACCESS_SECRET	Automatically reads the environment variable when the parameter is empty

export ACCESS_KEY="your-access-key"
export ACCESS_SECRET="your-access-secret"

Remote service address is controlled by the --address parameter, which supports the following values:

Parameter Value	Actual Service Address
nicsrs	https://ssl.face.nicsrs.com
Empty value, racent, or any other value	https://ssl.face.racent.com

Note

• ACCESS_KEY and ACCESS_SECRET are the environment variable names actually read, while SIGNTOOL_ACCESS_KEY / SIGNTOOL_ACCESS_SECRET will not be automatically read by the current CLI.
• It is not recommended to write the Access Secret into shell history or script repositories; prefer using runtime-injected environment variables or secure CI variables.

---

Parameter Description

Parameter	Short Form	Default Value	Description
--address	-a	Empty	Remote service address identifier, not a URL passthrough parameter.
--access-key	-k	Empty	Reads ACCESS_KEY if empty.
--access-secret	-s	Empty	Reads ACCESS_SECRET if empty.
--cert-code	-c	Empty	Required. Certificate number.
--file	-f	Empty	Required. Path to the file to be signed; cannot be a directory.
--out	-o	Empty	Output file path; when empty and overwrite is not enabled, a default file name is generated automatically.
--override	—	false	Overwrite the original file with the output file.
--sha1	-1	false	Enable SHA1 signature.
--sha2	-2	true	Enable SHA2 signature.
--timestamp	—	auto	SHA1 Authenticode timestamp address. auto uses the default address; an empty string disables it.
--timestamp-rfc3161	—	auto	SHA2 RFC3161 timestamp address. auto uses the default address; an empty string disables it.
--desc	-n	Empty	Description text of the program written into the signature.
--url	-u	Empty	Writes the URL of the program information for the signature.
--nest	—	true	Keeps the existing signature and appends a nested signature; clears the existing signature when false is set.
--verify	—	false	Returns an error if the certificate is not trusted when appending a signature.
--dry-run	—	false	Generates signatures using a local test certificate without calling the remote signing interface.

Boolean parameter format

Boolean parameters must use the 参数=值 format; space-separated values are not supported:

• Correct: --sha1=true --sha2=false
• Incorrect: --sha1 true --sha2 false

Required rules

The following conditions are validated before execution; if any one is not met, an error is reported and the process exits:

• --access-key or ACCESS_KEY must exist.
• --access-secret or ACCESS_SECRET must exist.
• --cert-code must exist.
• --file must exist and cannot be a directory.
• At least one of --sha1 and --sha2 must be enabled.

---

Output File Rules

When --out is not specified:

--override	Output behavior
false (default)	Outputs to the same directory as the input file, with the filename ${name}.signed.${yyyyMMdd.HHmmss}${ext}
true	Directly overwrites the input file

Example:

app.exe    → app.signed.20260611.153000.exe
driver.sys → driver.signed.20260611.153000.sys

Note

--override=true will overwrite the original file—please ensure you have backed it up before running it. If signing fails, the CLI will try to delete incomplete output files.

---

Algorithm Selection

Only SHA2 is enabled by default:

signtool sign -c CERT_CODE -f app.exe

Only sign with SHA1:

signtool sign -c CERT_CODE -f app.exe --sha1=true --sha2=false

Sign both SHA1 and SHA2:

signtool sign -c CERT_CODE -f app.exe --sha1=true --sha2=true

Note

When both SHA1 and SHA2 are enabled, the workflow processes SHA1 first, then SHA2. SHA1 is still supported, but SHA2 is preferred for new signing scenarios.

---

Timestamp Configuration

--timestamp and --timestamp-rfc3161 auto values are replaced with default addresses during the validation phase:

Parameter	auto actual value	Purpose
--timestamp	http://timestamp.sectigo.com	SHA1 Authenticode timestamp
--timestamp-rfc3161	http://timestamp.sectigo.com	SHA2 RFC3161 timestamp

Custom SHA2 timestamp service:

signtool sign \
  -c CERT_CODE \
  -f app.exe \
  --timestamp-rfc3161=http://timestamp.acs.microsoft.com

Closing SHA2 timestamp:

signtool sign -c CERT_CODE -f app.exe --timestamp-rfc3161=

Close all timestamps:

signtool sign -c CERT_CODE -f app.exe --timestamp= --timestamp-rfc3161=

Note

• Only timestamp addresses starting with http will be used.
• For SHA1, --timestamp is preferred; if it is not an HTTP address, --timestamp-rfc3161 will be attempted instead.
• SHA2 uses --timestamp-rfc3161.
• If adding a timestamp for SHA2 fails, the CLI will automatically retry once between the Microsoft and Sectigo default addresses.
• A timestamp failure does not necessarily cause the signing to fail; the CLI will log the error and retain the signature result without a timestamp.

---

Common Examples

Provide credentials via environment variables, with default SHA2 signing:

export ACCESS_KEY="your-access-key"
export ACCESS_SECRET="your-access-secret"

signtool sign \
  --cert-code CERT_CODE \
  --file app-unsigned.exe \
  --out app-signed.exe

Provide credentials directly using parameters:

signtool sign \
  --access-key "your-access-key" \
  --access-secret "your-access-secret" \
  --cert-code CERT_CODE \
  --file app-unsigned.exe \
  --out app-signed.exe

Using the NICSRS address:

signtool sign \
  --address nicsrs \
  --cert-code CERT_CODE \
  --file app-unsigned.exe \
  --out app-signed.exe

Write the program description and official website URL:

signtool sign \
  -c CERT_CODE \
  -f app-unsigned.exe \
  -o app-signed.exe \
  --desc "Example Application" \
  --url "https://example.com"

Appending a Nested Signature (Preserving Existing Signatures):

signtool sign -c CERT_CODE -f app.exe --nest=true

Overwrite the original file:

signtool sign -c CERT_CODE -f app.exe --override=true

dry-run local test signing (without calling remote interfaces):

signtool sign \
  -k dummy \
  -s dummy \
  -c CERT_CODE \
  -f app.exe \
  --dry-run=true

Note

--dry-run does not invoke the remote signing API, but it still reads and writes local files and calls the local self-signed certificate. Validation for non-empty credentials and certificate numbers still occurs, so the example uses placeholder credentials.

---

Troubleshooting Reference

Error Message	Possible Cause	Recommended Action
access key is required...	--access-key was not provided, and ACCESS_KEY was not set either.	Set the environment variable or use -k.
access secret is required...	Neither --access-secret provided nor ACCESS_SECRET set.	Set the environment variable or use -s.
cert code is required...	Certificate number not provided.	Use -c CERT_CODE.
sha1 or sha2 is required...	Both SHA1 and SHA2 are disabled.	Enable at least one algorithm.
file <path> is a directory	--file points to a directory rather than a file.	Change it to the path of the file to be signed.
Timestamp failed but signature file generated	Timestamp service unavailable or certificate chain validation failed.	Check the timestamp URL and replace --timestamp-rfc3161 if necessary.