.png){kind=logo}
SignServer is built around a modular, Worker-based architecture.
SignServer Workers are configured to perform certain activities like signing files of a certain type, often with a specific key. Each Worker is an independent processing unit that performs a specific cryptographic or operational task. Workers interact with shared system components to deliver signing services, such as configuration, validation, and crypto providers.
The configuration and logs are optionally stored in a database.
Workers: The Core Execution Units
A Worker is a self-contained module with its own configuration and lifecycle.
Workers are configured by setting properties in the Worker configuration. The common configuration options handled by the framework apply to all Workers. In addition, there are Worker-specific properties, handled by the Worker implementation. For more information, see Common Worker Properties.
Signer Workers
Signers are the most common Workers and perform signing operations. A Signer specifies how to perform the signature creation, and which key and certificate to use.
Signers perform cryptographic operations such as:
-
Code signing
-
Document signing (PDF, XML)
-
Timestamping (TSA)
-
Key generation & certificate requests
Helper / Service Workers
Workers that do not sign but support other processes:
Worker
Description
Checks the signature and the certificate(s) in documents.
Forwards requests to another Worker, and does not perform any processing of its own.
Validates certificates from one or more issuers.
Runs on a timely basis, performing maintenance tasks like changing active keys or generating a report.
For a list of other SignServer Workers with special functionalities, see Other Workers.
Crypto Tokens
Workers needing private keys do not talk directly to HSMs or Keystores. Instead, they use a Crypto Worker with a configured Crypto Token which abstracts the crypto backend.
For more information, see Crypto Tokens: HSMs & Keystores.
Components for Workers
Components provide specific functionality and are configured in the SignServer Workers.
Examples of components include:
Component
Description
Decides if a request should be allowed or not.
Allows controlling how the key used for signing is selected at run-time based on the signing request.
Allows the Archiver to store requests or responses by configuring one or more on a Worker.