Signum Agents | Keyfactor Docs

ENterprise

Signum Agents expose a platform-native keystore interface (macOS Keychain or PKCS#11 token) backed by SignServer. Any tool that can sign via the OS keystore or a PKCS#11 module can use this path without modification. In both cases, the underlying SignServer worker handling the request is a Plain Signer.

Signing with platform-native signing tools allows you to:

Use familiar signing tools which are broadly supported by your operating system.
Streamline signature verification.
Eliminate signature formatting issues.

The Signum Agents function as a client option for signing with native tools. These Agents are also “hybrid”, allowing you to set up either Signum or SignServer as backend.

For information on Signum as backend, see the Signum SaaS Documentation.

Supported Platforms

SignServer supports the following Signum Agents:

For access to the managed API used by Signum to connect to SignServer, there is a managed role option. To check if a managed role is configured, see the Administrators Page.

Native Signing Tools

macOS: codesign

codesign is Apple's native tool for signing macOS applications, frameworks, bundles, and scripts. It resolves signing identities from the macOS Keychain.

The Signum macOS Agent presents a virtual keychain identity to the operating system. Once the agent is configured and the certificate is added to the keychain with signum-util keychain --add, codesign discovers it automatically. The private key remains protected in SignServer's HSM-backed crypto token and is never exposed to the local machine.

Example:

codesign -s <certificate-thumbprint> -v myapp.app

macOS: productsign

productsign is Apple's tool for signing macOS installer packages (.pkg). Like codesign, it resolves signing identities from the macOS Keychain and works with the same Signum macOS Agent integration.

Linux: openssl

openssl supports signing operations via a PKCS#11 engine, allowing it to delegate cryptographic operations to any token that exposes a PKCS#11 interface.

The Signum Linux Agent installs a PKCS#11 module (libkeyfactorpkcs11.so) that exposes SignServer-managed keys as a virtual PKCS#11 token. Once configured in openssl.cnf, openssl dgst can sign using the engine, forwarding the signing operation to SignServer via the Agent. The key never leaves the HSM.

Example:

openssl dgst -engine pkcs11 \
  -keyform engine \
  -sha256 \
  -sign "pkcs11:token=Keyfactor for Linux" \
  -out signature.bin \
  file.txt

Configure a Signum Agent