Installation Prerequisites

Before installing SignServer, review the following list of required software to be installed:

Java
OpenJDK 21	Note: Only tested with WildFly 38. See the following limitations when using SignServer with Java 21: Legacy XAdES Unsupported Not supported on Java 21. Use Java 17 or migrate to the modern AdES Signer. PKCS11CryptoToken Key Deletion Due to a Java 21 bug, deleting keys may fail to remove all objects in the HSM when multiple certificates share the same Issuer DN. Consider using P11NG CryptoToken or use Java 17. PKCS11CryptoToken Limitation The PKCS11CryptoToken does not work on Java 21 unless the Java process that runs the application server is passed the JAVA_OPTS parameter -`-add-exports=jdk.crypto.cryptoki/sun.security.pkcs11.wrapper=ALL-UNNAMED`. See Troubleshooting.
OpenJDK 17	PKCS11CryptoToken Limitation The PKCS11CryptoToken does not work on Java 17 unless the Java process that runs the application server is passed the JAVA_OPTS parameter -`-add-exports=jdk.crypto.cryptoki/sun.security.pkcs11.wrapper=ALL-UNNAMED`. See Troubleshooting.
Application Server
WildFly 39	Recommended. For instructions on how to set up your application server, see Application Server Setup.
WildFly 38	For instructions on how to set up your application server, see Application Server Setup.
WildFly 35	For instructions on how to set up your application server, see Application Server Setup.
WildFly 32	For instructions on how to set up your application server, see Application Server Setup.
JBoss EAP 8	For instructions on how to set up your application server, see Application Server Setup.
Database
MariaDB 10 / MySQL 5.5	Recommended.
PostgreSQL 10
Oracle Database 24
Microsoft SQL Server
NoDB	You can choose to install SignServer without a database management system and instead rely on SignServer to manage persistence using local files, see SignServer without Database.
Deployment Tool
Apache Ant 1.9.1 or later
Optional: Build Tool
Apache Maven 3.2.5 or later	Only required when building SignServer from source. Note: Building is currently only supported using OpenJDK 17.
Optional: Locale
UTF-8	This makes sure the file name is properly sent back from SignServer even with special characters.
Time Synchronization
Network Time Protocol (NTP)	Required when automatic configuration reload is enabled in high availability environments. A maximum clock skew of 10 seconds is assumed, requiring all nodes to stay within this tolerance to maintain correctness and reliability.