Additional Configuration

The following sections list additional configuration relevant for Code Signing but not specific to any signer:

Authentication and Authorization

To limit access to the workers, SignServer offers different authentication and authorization options configured per worker.

Client Certificate

With AUTHTYPE set to client certificate, only clients authenticating with a certificate trusted by the application server and for which the certificate serial number is listed in the worker's authorization list are allowed.

Username / Password

This AUTHTYPE implementation uses user names and passwords stored in the configuration. For testing and demonstration purposes, clear-text passwords can be used, and for real use cases the passwords can be hashed and salted:

Authentication Proxy

In case SignServer is set up behind a reverse proxy, such as Apache HTTP Server or Nginx, performing the authentication using any of its supported methods (i.e. HTTP auth or LDAP/Active Directory). SignServer can be configured to only look at the supplied user name and either accept all users or only specified users.

For more authorization alternatives, such as limiting access based on the client's IP address, refer to the the SignServer Manual.

Worker Logging

By default, transactions (signings) are only logged to file (and for the PKI Appliance to syslog). The WORKERLOGGER worker property can be set to enable logging to the database. When enabled, all available log fields are included by default and can be limited to include only a subset or to exclude certain fields:

Maximum Upload Size

SignServer imposes a soft limit by refusing to process uploads with a size over 100 MB. This limit can be configured by setting a global configuration property.