signdatagroups | Keyfactor Docs

Use the SignClient signdatagroups command to sign the specified data groups and produce an SOd (MRTD).

Command Options

Option	Description
`-accesstoken <arg>`	Access token to use for JWT authentication. Can only be used with protocol HTTP or REST.
`-data <arg>`	Data to send to the Worker.
`-encoding <arg>`	Encoding of the data option: `none` or `base64`. Default: `none`.
`-host <arg>`	Server name or IP address. Default: `localhost`
`-keyalias <arg>`	Alias of the key in the keystore to use for authentication.
`-keystore <arg>`	Keystore with private key and certificate for client certificate authentication.
`-keystorepwd <arg>`	Password for reading the keystore. If `-keystore` is specified but not `-keystorepwd`, the CLI instead prompts for the password.
`-metadata <arg>`	Additional metadata to send to the Signer. The parameters should be given in the format `KEY=VALUE`. This option can be provided multiple times.
`-password <arg>`	Password for authentication. If `-username` is specified but not `-password`, the CLI instead prompts for the password.
`-port <arg>`	Server port. Default: `8080` (for HTTP), `8442` for HTTPS, and `8443` for HTTPS with client authentication.
`-protocol <arg>`	Method of interacting with SignServer: `HTTP` or `CLIENTWS`. Default: `HTTP`.
`-repeat <arg>`	The number of times the operation will run. Default: `1`
`-servlet <arg>`	Servlet to call. Default: `/signserver/sod`
`-truststore <arg>`	Keystore with trusted certificates to use with HTTPS.
`-truststorepwd <arg>`	Password for the keystore with trusted certificates. If `-truststore` is specified but not `-truststorepwd`, the CLI instead prompts for the password.
`-username <arg>`	Username for authentication.
`-workerid <arg>`	ID of Worker performing the operation.
`-workername <arg>`	Name of Worker performing the operation.

Example Use Cases

Sign Plain Text

Send three data groups (numbered 1, 2, and 3) as plain text values to the MRTD SOD signer. Data groups are passed as a single &-separated string of GROUPNUMBER=VALUE pairs. The command uses the default HTTP protocol and no encoding (raw text):

signdatagroups -workername MRTDSODSigner -data "1=value1&2=value2&3=value3"

Sign Base64-encoded Hashes

Sign with data group values that are Base64-encoded hashes rather than plain text strings:

signdatagroups -workername MRTDSODSigner -data "1=PJaDAX+eS/M9D77dJr8UP9ct6bndFFRBt18GBAR+oo4=&2=BTfUgfc6dXM0MoBS2jr5YmztlwKOILhJ9hFcIs12UZc=&3=idxq5/Bqn0a1Za8D6rDs4L9gJNNlm346HQNXPP6wtZ0="

Note that despite the values being Base64, the -encoding flag is not used here. The encoding flag controls how the -data argument itself is interpreted by SignClient, not the format of the values within it.

Sign with Additional Metadata

If the Worker is configured to accept or require extra parameters, pass additional key-value metadata to the Signer alongside the data groups:

signdatagroups -workername MRTDSODSigner -data "1=value1&2=value2&3=value3" -metadata param1=value1 -metadata param2=value2