.png){kind=logo}
The following provides an overview of SignServer's capabilities and support, with relevant links to documentation and external standards.
SignServer supports multiple application servers and standard, high-performance databases. For more information on SignServer requirements, see Prerequisites.
Algorithms
SignServer supports* the following algorithm types and key size/curves.
|
Algorithm |
Key Size/curve |
|---|---|
|
RSA |
Keys up to and including 8192 bits. |
|
ECDSA |
ECDSA key algorithm with named curves. |
|
EdDSA |
Pure EdDSA with Edwards25519 or Edwards448 |
|
Hash algorithms |
Hash algorithms for signatures, SHA-1, SHA-2. |
|
NSA SUITE B |
Compliant with NSA SUITE B algorithms and certificates. |
|
ML-DSA |
ML-DSA-44
|
|
SLH-DSA |
SLH-DSA-SHA2-128F
|
*See individual workers and crypto tokens for information about what they support. For more information, see Signers Algorithm Support.
Signature Formats
Document Signing
SignServer can easily be adapted to customer-specific needs by using plug-ins and supports document signing formats such as the ones listed below.
|
Format |
Documentation |
|---|---|
|
PDF (ISO 32000) PDF document processing, including support for:
|
|
|
PAdES (-B, -T, -LT, -LTA) (PDF Advanced Electronic Signatures)
|
Enterprise |
|
XAdES (–B, -T, -LT, -LTA) (XML Advanced Electronic Signatures)
|
Enterprise |
|
CAdES (–B, -T, -LT, -LTA) (CMS Advanced Electronic Signatures) |
Enterprise |
|
XAdES (XAdES-BES and XAdES-T) |
|
|
XML (XMLdSig) |
|
|
CMS/PKCS#7 Generic CMS (PKCS#7) signer signs any document or file with support for encapsulated content or detached signatures and client-side hashing. |
|
|
CMS signing with support for time-stamping |
Enterprise |
Code Signing
SignServer supports code signing formats such as the following.
|
Format |
Documentation |
|---|---|
|
Plain signing |
|
|
CMS signing |
|
|
OpenPGP signing |
|
|
Java code signing including
|
|
|
CMS signing + time-stamping |
Enterprise |
|
OpenPGP signing with client-side hashing |
Enterprise |
|
Authenticode signing including:
|
Enterprise |
|
Microsoft APPX package signing (AppX) |
Enterprise |
|
Java code signing with client-side hashing |
Enterprise |
|
Android (APK) signing v1, v2 and v3 |
Enterprise |
|
Debian package signing (dpkg-sig) |
ePassport
SignServer is used both for MRTD signing and for ICAO CSCA Master list signing.
|
ePassport |
Documentation |
|---|---|
|
Document (MRTD SOD) signing with Logical Data Structure (LDS) version 1.7 and 1.8 support |
|
|
Document (MRTD) signing |
(Legacy)
|
|
ICAO CSCA Master list signing |
Enterprise
|
|
Additional algorithm support
|
|
Time-stamping
SignServer can be used as the time stamp unit within a Time Stamp Authority (TSA) to generate digitally signed time stamps and includes monitoring of time synchronization, offering both RFC 3161 and MS Authenticode time-stamps.
|
Format |
External References |
Documentation |
|---|---|---|
|
Basic Time-stamping |
||
|
Professional Time-stamping including:
|
Enterprise |
Supported Hardware Security Modules (HSMs)
The following table lists HSM support for each SignServer deployment option. Integration methods include PKCS #11 standard and REST APIs. SignServer additionally supports software-based keys for lower security requirements or development.
|
HSM Type |
Software stack |
Cloud |
Software Appliance |
Hardware Appliance |
Container Set |
|
Network HSMs integrated with REST APIs |
|||||
|
Azure Key Vault / MS Managed HSM |
✔️ |
✔️
|
|
|
✔️
|
|
Fortanix Data Security Manager (DSM) |
✔️
|
|
|
|
✔️ |
|
Securosys Primus HSM and CloudHSM Service |
|
|
✔️ |
|
|
|
Network HSMs integrated with PKCS#11 |
|||||
|
AWS CloudHSM |
✔️
|
✔️ |
|
|
|
|
Bull TrustWay Proteccio |
✔️
|
|
✔️ |
|
|
|
CloudHSM Service
|
|
|
✔️ |
|
|
|
Entrust nShield Connect/5c |
✔️
|
|
✔️ |
|
|
|
Securosys Primus
|
|
|
✔️ |
|
|
|
SoftHSMv2 |
✔️
|
|
|
|
✔️ |
|
Thales DPoD |
✔️
|
|
✔️
|
|
|
|
Thales Luna 7 |
✔️ |
|
✔️
|
|
✔️
|
|
Thales USB HSM
|
|
|
✔️ |
|
|
|
Thales TCT |
✔️ |
|
✔️ |
|
|
|
Utimaco CryptoServer |
✔️ |
|
✔️
|
|
✔️ |
|
Utimaco u.trust Anchor
|
✔️ |
|
✔️ |
|
|
|
Internal Hardware Appliance PCIe HSMs integrated with PKCS#11 |
|||||
|
Thales Luna PCIe |
✔️ |
|
|
✔️ |
|
|
Utimaco PCIe |
✔️ |
|
|
✔️ |
|
Integration Interfaces
SignServer provides multiple integration interfaces, such as:
-
SignClient Interface and Administration CLI.
Native Signing Tools
SignServer supports several native signing tools, such as:
-
codesign
-
productsign
-
rpm-sign