Breadcrumbs

Sign with Plain Signatures

A plain signature is the simplest signature format in SignServer. The plain signature is the raw output bytes of the chosen signature algorithm, with no embedded certificate, public key, or original document.

This makes it useful in situations where the receiver already has access to the certificate or public key through another channel. For example, in firmware on embedded devices, it could be that a list of trusted certificates or public keys is pre-installed, or as part of a custom protocol that encodes certificates separately.

Plain Signer Configuration Properties

The following property is the most relevant when configuring the Plain Signer:

Property

Description

SIGNATUREALGORITHM

The algorithm used to sign the data. Example: SHA256withRSA

For all available properties, see Plain Signer.

Supported signature algorithms include:

  • ECDSA: SHAxWithECDSA, NONEwithECDSA

  • RSA: SHAxWithRSA (RSASSA-PKCS1_v1.5), SHAxWithRSAandMGF1 (RSASSA-PSS), NONEwithRSA

  • ML-DSA: Pure ML-DSA-<44/65/87>, ML-DSA-EXTERNAL-MU

  • SLH-DSA: Pure SLH-DSA <SHA2/SHAKE> (hash function) <128/192/256> (size specification) <f/s> (fast or small)

Supported cryptographic hash functions can be SHA-1, SHA-256, SHA-384, and SHA-512, and so on. For information on using the signature algorithms NONEwithRSA and NONEwithECDSA, refer to Client-side Hashing and RFC#3447.

For more supported algorithms, see Plain Signer Algorithm Support.

Set up the Plain Signer

Step 1 - Add and Configure the Signer

  1. Open the Admin Web, and go to the Workers page.

  2. Click Add and select From Template.

  3. Choose plainsigner.properties and click Next.

  4. Click Apply.

  5. Select the Worker named PlainSigner from the list.

  6. Click the Configuration tab and update the following properties:

    • NAME: Set a descriptive name for the worker.

    • CRYPTOTOKEN: set this to match your Crypto Token.

  7. Click the Status Summary tab, and click Renew Key.

  8. Select a Key Algorithm (for example, RSA) and Key Specification (for example, 2048), and click Generate.

Step 2 – Generate a CSR and Install the Certificate

If you set the NOCERTIFICATES property to true, the Plain Signer does not require a certificate. Skip this step and confirm the Worker status is Active.

  1. Click Generate CSR.

  2. Choose a Signature Algorithm, such as SHA256withRSA, and enter a Subject DN for the new certificate such as CN=Plain Signer Test,O=My Company, C=SE.

  3. Click Generate.

  4. Click Download and save the CSR file.

  5. Submit the CSR to your Certificate Authority. The CA returns the signed certificate and any CA certificates in the chain.

Before installing certificates in a production system, verify the Signer authorization settings. Once certificates are installed, the signer will be fully functional and ready to receive requests.

  1. Click Install certificates. Provide the Signer certificate first and then add the issuing CA certificates in order.

  2. Click Add to append the certificates to the chain.

  3. When all certificates have been added in the correct order, click Install.

  4. Confirm the Worker status is Active. If not, check the Status Summary page for errors.

Sign a File

You can submit files for signing using the Client Web, the SignClient, or HTTP clients like cURL.

Using Client Web

To upload a file and create a detached signature for it, perform these steps:

  1. Go to the SignServer Client Web Generic page.

  2. Scroll down to the Generic Signing Or Validation by File Upload section and specify PlainSigner in the Worker Name field.

  3. Click Choose File, select the file to create a detached signature for, such as release.zip.                                                                                                         

    Screenshot from 2023-01-02 13-27-38.png

  4. Click Submit.

  5. Save the resulting signature file, for example, release.zip.asc.

Using SignClient

Send a signing request using the SignServer SignClient:

bin/signclient signdocument -workername PlainSigner1 -infile firmware.bin -outfile firmware.sig

Where workername is the name of the Worker, infile is the path to the file to sign, and outfile is where the signature will be written to.

The SignClient can also run (as User) in batch mode, which processes all files in an input directory across parallel threads and writes results to an output directory:

bin/signclient signdocument -workername PlainSigner1 -indir ./input/ -removefromindir -outdir ./output/ -threads 10

Using cURL

Replace http://localhost:8080/ with the address of your server or appliance:

Bash
curl -F "workerName=PlainSigner1" -F "file=@firmware.bin" \
http://localhost:8080/signserver/process > firmware.sig

The following shows the HTTP traffic between the browser and the server, and the resulting signature file response:

Showing the HTTP traffic between the browser and the server
Showing the HTTP traffic between the browser and the server
Response with the signature file
Response with the signature file

Verify the Signature

Use the OpenSSL dgst command to verify a plain signature. The command requires the public key, so it must first be extracted from the certificate:

openssl x509 -in plainsigner1.pem -noout -pubkey > plainsigner1-pubkey.pem 
openssl dgst -signature firmware.bin.sig -verify plainsigner1-pubkey.pem -sha1
    firmware.bin 
Verified OK

Replace -sha1 with the digest algorithm used as part of the signature process, for example -sha256.